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PREFACE 


Time  Safety  Margin  (TSM)  was  originally  developed  following  the  catastrophic  loss  of  Mr.  David 
“Cools”  Cooley  during  an  unsuccessful  high  Mach,  high  altitude  dive  recovery  following  an  F-22A  test 
point.  It  was  founded  on  the  work  of  earlier  test  teams,  especially  Available  Reaction  Time  (ART),  a  metric 
created  by  the  F-16  Automatic  Ground  Collision  Avoidance  System  test  team.  Special  thanks  go  to  Kevin 
Prosser  of  Calspan  Corporation  for  his  explanations  of  ART;  Bill  Kuhlemeier  and  Jim  Brown  of  the  F-22 
Combined  Test  Force  for  their  application  of  pilot  reaction  time  to  F-22  dive  recovery  planning  in  wings- 
level  dives;  Chris  Childress  and  Aaron  Reed  of  the  412th  Operations  Group  for  their  insightful  help  with 
turning  TSM  into  a  regulation;  and  the  2009  Air  Force  Flight  Test  Center,  Test  Wing,  and  Operations  Group 
leadership  for  their  care  ful  consideration  and  feedback.  Much  of  the  beginning  of  this  handbook  is  based 
on  a  paper  written  with  Jim  Brown  for  the  Society  of  Experimental  Test  Pilots  in  2009  entitled  Time  Safety 
Margin:  A  Generalized  Method  for  Dive  Safety  Planning. 

In  the  intervening  years,  TSM  has  proven  a  valuable  tool  for  dive  safety  planning  and  much  has  been 
learned  about  its  practical  application.  This  handbook  has  been  prepared  to  provide  guidance  on  the  use  and 
limitations  of  TSM.  It  also  addresses  a  known  shortcoming  of  the  original  TSM  method;  handling  dives — 
such  as  a  split-s  maneuver — where  an  unexpected  delay  at  the  recovery  initiation  conditions  can  result  in  a 
much  lower  TSM  than  expected. 
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INTRODUCTION 


Diving  maneuvers  arc  common  throughout  flight  test.  Obvious  cases  include  weapons  deliveries  or 
maneuvers  designed  to  achieve  conditions  at  high  negative  specific  excess  power  (Ps)  ,  but  there  are  less 
obvious  cases,  including  testing  at  unusual — even  climbing — attitudes  that  will  result  in  a  dive  following 
the  completion  of  the  test  point.  The  wide  variety  of  maneuvers,  aircraft,  pilot  skill,  and  environments  that 
may  require  or  result  in  hazardous  dives  have  historically  driven  the  dive  planning  problem  to  be  treated  as  a 
unique  issue  for  each  airframe  or  event.  In  the  absence  of  proven  guidance,  test  teams  relied  for  many  years 
on  a  mix  of  subjective  engineering  judgment  (intuition)  and  objective  planning  to  find  the  right  balance  of 
risk  and  mission  accomplishment. 

In  the  spring  of  2009,  the  Air  Force  Flight  Test  Center  (AFFTC)1 2  at  Edwards  AFB  experienced  the  very 
tragedy  that  all  flight  test  professionals  seek  most  to  avoid;  the  loss  of  a  colleague  in  the  accomplishment  of 
a  test  point.  As  the  many  necessary  official  investigative  processes  were  underway,  Dave  “Cools”  Cooley’s 
friends  and  coworkers — including  the  author  of  this  handbook — embarked  on  a  course  of  intense  introspec¬ 
tion.  They  asked  “What  did  we  miss?”  and  sought  to  honor  their  friend  by  acting  to  prevent  anything  like 
it  from  happening  again.  In  the  difficult  first  few  weeks  following  the  loss,  it  became  apparent  that  the  as¬ 
tonishing  performance  characteristics  of  modern  fighters  had  exceeded  the  intuitive  understanding  of  some 
of  the  most  experienced  flight  testers  on  the  planet.  The  crash,  proximately  caused  by  insufficient  altitude 
during  a  supersonic  dive  recovery,  showed  that  the  expectations  of  dive  recovery  requirements  were  limited 
by  intuitions  developed  over  decades  of  flying  and  testing  earlier-generation  fighter  aircraft  (reference  1). 


Figure  1  F-22  Impact  Crater 


1  All  abbreviations,  acronyms,  and  symbols  are  defined  in  appendix  D. 

2  In  2012,  the  AFFTC  and  several  other  United  States  Air  Force  Material  Command  (AFMC)  test  centers  were  combined  to  become 
the  Air  Force  Test  Center  (AFTC).  All  references  to  the  AFFTC  refer  to  the  earlier  organization. 
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The  AFFTC  leadership  quickly  began  the  process  of  procedurally  correcting  this  deficiency  by  insti¬ 
tuting  conservative  dive  planning  requirements  based  upon  operational  techniques.  These  restrictions  were 
quickly  found  to  be  overly  conservative.  While  ensuring  sufficient  dive  recovery  altitude  and  “knock-it-ofF’ 
procedures,  they  unnecessarily  impacted  many  routine  maneuvers  and  test  techniques.  With  test  teams  pro¬ 
viding  this  feedback  and  with  the  results  of  the  F-22  Combined  Test  Force  (CTF)  mishap  analysis  and  safety 
planning  revision  efforts  clearly  indicating  the  potential  for  a  more  nuanced  approach,  AFFTC  leadership 
created  the  Dive  Safety  Working  Group  to  bring  a  wide  range  of  backgrounds  and  experience  to  the  problem. 
Time  safety  margin  (TSM)  was  the  result  of  this  effort.  Time  Safety  Margin  is  most  simply  described  as  the 
time  an  aircraft  conducting  a  maneuver  that  includes  a  dive  may  remain  on  its  worst-case  vector  until  the 
planned  recovery  will  no  longer  be  sufficient  to  prevent  impact  with  the  ground.  By  linking  test  point  plan¬ 
ning,  training,  buildup,  and  review  requirements  to  the  maneuver  TSM,  a  rational  and  universally  applicable 
approach  to  dive  safety  planning  was  instituted  for  USAF  flight  test  planning. 

As  with  flight  test,  the  real  testing  isn’t  complete  until  the  “user”  has  been  exercising  the  system  for  a 
while.  Routine  application  of  TSM  to  test  planning  has  shown  that  the  method  does  not  adequately  capture 
the  risk  involved  in  maneuvers  where  the  TSM  is  decreasing  rapidly  prior  to  the  recovery.  This  isn’t  a 
problem  so  long  as  the  TSM  is  not  decreasing  by  more  than  one  second  for  every  second  that  the  maneuver 
is  continued,  but  if  the  TSM  is  decreasing  by  more  than  one  second  for  every  second  then  the  actual  risk  of 
the  maneuver  may  be  much  higher  than  the  TSM  indicates.  Delayed  Time  Safety  Margin  (DTSM) — defined 
in  this  handbook — may  be  used  to  capture  this  effect  in  the  TSM  calculation. 
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TRADITIONAL  DIVE  PLANNING  METHODS 


Most  pilots  experience  flying  within  the  context  of  their  current  aircraft  and  focus  exclusively  on  the 
procedures  and  techniques  specific  to  that  aircraft  and  environment.  The  wide  variety  of  aircraft  flying 
qualities  and  performance  characteristics — and  pilots — could  create  a  bewildering  variety  of  techniques, 
but  pilots  are  not  interested  in  being  bewildered;  they  want  the  simplest  set  of  rules  that  work.  Thus, 
simple  rules-of-thumb  are  evolved  in  one  community,  transmitted  to  others,  and  perhaps  eventually  written 
as  regulations.  If  these  rules  become  regulations  their  origin  and  environment  are  rapidly  forgotten,  making 
it  more  likely  for  them  to  be  adopted  by  other  communities  for  situations  to  which  they  may  be  less  suited. 
Regardless,  once  these  rules  are  adapted  and  published,  they  live  unquestioned  in  virtual  perpetuity. 

The  necessity  of  planning  for  dive  recovery  has  created  a  variety  of  techniques  and  requirements.  The 
origin  of  these  methods  can  be  surmised  by  examining  where  and  when  they  work.  We  will  examine  some 
of  these  rules,  speculate  on  their  origin,  and  see  where  they  can  become  traps. 

LINEAR  RULES 

Linear  rules  are  simple  methods  for  relating  an  altitude  above  ground  level  (AGL)  with  a  dive  angle.  The 
exceptionally  simple  “50%  Rule”  is  common  in  communities  that  have  relatively  low  g3  limits.  If  you  are 
diving  (in  degrees)  at  more  than  half  your  altitude  above  the  ground  (in  hundreds  of  feet)  you  are  too  steep 
for  comfort.  (The  50%  rule  has  also  been  called  the  “AGL/200  Rule”  or  “Rule  of  200.”  For  a  short  time 
following  the  2009  F-22  mishap,  the  AFFTC  used  the  “Rule  of  200”  to  set  the  maximum  allowable  dive 
angle  for  flight  test  dives.)  Figure  2  depicts  typical  guidance  for  this  rule  as  published  in  the  Chief  of  Naval 
Air  Training  (CNATRA)  manual  Low  Altitude  Awareness  Training  (reference  2).  In  contrast,  the  “AGL/100 
rule”  is  more  suitable  for  fighter-type  aircraft.  According  this  rule  the  maximum  dive  angle  is  simply  the 
AGL  altitude  in  feet  divided  by  100,  so  4,500  ft  AGL  would  correspond  to  a  maximum  dive  angle  of  45 
degrees. 


The  50%  rule  is  a  simple  set  of  do-not-exceed  dive  angle  numbers  corresponding  with  specific 
AGL  altitudes  that  ensure  a  safe  expeditious  descent  from  5000  ft  AGL  to  a  point  where  the  dive 
recovery  rules  apply.  For  example  a  pilot  at  4000  ft  AGL  would  use  a  20°  FPA  until  reaching 
3000  ft  AGL  then  decrease  his  FPA  to  15°  until  2000  ft  AGL  and  so  on. 


Altitude  (AGL) 

Dive  Annie 

5000’ 

25° 

4000’ 

20° 

3000’ 

15° 

2000’ 

10° 

1000’ 

5° 

Figure  2  The  50%  Rule  reproduced  from  CNATRA  Low  Altitude  Awareness  Training 


Linear  rules  have  the  advantage  of  being  simple  and  easy  to  use  “on  the  fly.”  But  dive  recovery  altitudes 
do  not  vary  linearly  with  dive  angle,  and  the  specific  relationship — be  it  the  “Rule  of  200,”  the  “AGL/100 
Rule,”  or  some  other  rule — comes  with  unspoken  and  too-often  unrecognized  assumptions  about  aircraft 
speed  and  performance  capability.  For  instance,  figure  3  depicts  the  5  g-recovery  flight  path  for  three  aircraft 
at  different  airspeeds,  each  starting  at  the  minimum  altitude  for  a  vertical  dive  using  the  AGL/100  rule.  It  is 

3  Pilots  typically  refer  to  cockpit  normal  acceleration  (A/.),  as  “G”  or  “g”  reflecting  the  convention  of  expressing  the  Nz  in  units  of 
local  gravitational  acceleration,  “g”  will  be  used  as  shorthand  for  “g  IV- ”  in  this  handbook. 
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cleai-  that  this  rule  came  from  the  classic  fighter  community  because  the  0.9  Mach  number  (MN)  recovery  is 
completed  with  altitude  to  spare.  At  very  low  and  very  high  speed,  the  rule  fails;  a  small  aerobatic  aircraft 
at  1 80  KC AS  completes  the  recovery  with  a  grossly  over-conservative  margin  while  an  aircraft  recovering 
at  1.6  MN  hits  the  ground  while  still  in  a  63-degree  descent! 


Figure  3  Constant  5-g  Recovery  Paths  for  Three 
Different  Airspeeds 


MINIMUM  SAFE  ALTITUDES 

Minimum  safe  altitudes  (MSAs)  are  the  most  common  safety  rules  for  reducing  the  risk  of  ground  im¬ 
pact.  A  few  examples  of  MSAs  are  minimum  altitudes  for  certified  airshow  demonstration  pilots,  minimum 
recovery  altitudes  for  bomb  ranges,  minimum  altitudes  for  aerobatic  flight,  and  “the  floor”  for  practice  air- 
to-air  combat.  The  pilot  is  relied  upon  to  use  planning  and  airmanship  to  assure  that  these  limits  aren’t 
exceeded. 

Unfortunately,  MSAs  poorly  address  the  likelihood  of  the  pilot  making  a  fatal  error.  For  instance, 
if  the  minimum  altitude  for  aerobatics  is  5,000  feet  AGL  a  pilot  can  make  a  pretty  significant  error  and 
survive.  This  is  not  the  case  with  an  MSA  for  a  low-angle  strafe  run — typically  75  feet  AGL — where  a  too- 
steep  approach  or  slight  delay  in  initiating  recovery  can  result  in  disaster.  Minimum  safe  altitudes  typically 
provide  a  limit  that  is  used  to  develop  procedures  and  training  to  ensure  that  the  MSA  is  not  violated,  but 
pilots  may  not  be  aware  of  the  actual  margin  for  error  that  any  given  MSA  provides. 

PRE-TSM  FLIGHT-TEST  DIVE  PLANNING  METHODS 

Flight  test  dive  planning  at  the  AFFTC  prior  to  2010  was  the  responsibility  of  the  test  team.  Each  test 
team  chose  or  developed  a  methodology  that  suited  their  needs.  Their  plan  was  independently  reviewed 
and  approved  prior  to  initiating  test  flights.  Most  of  the  time,  informal  methods  were  used  that  were  al¬ 
most  entirely  based  on  the  test  pilots’  experience  and  the  expectations  of  the  independent  reviewers  and 
approval  authorities.  One  test  team  made  an  important  conceptual  leap  in  the  mid-1990’s  while  planning 
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for  automatic  ground  collision  avoidance  testing  (GCAS),  but  their  ground-breaking  methodologies  were 
not  applied  outside  of  their  test;  they  viewed  their  technique  merely  as  a  risk-assessment  method  for  GCAS 
tests. 

Informal  Methods: 


Most  flight  test  dive  planning  history — at  least  the  result  of  that  history — can  be  summarized  quite  sim¬ 
ply.  First,  test  teams  examined  their  flight  test  maneuvers  and  determined  which  ones  had  a  significantly 
increased  risk  of  ground  impact.  This  was  typically  accomplished  using  the  advice  (intuition)  of  the  test 
pilots  regarding  which  maneuvers  may  cause  problems,  ideally  taking  into  account  other  factors  such  as 
pilot  workload  and  the  system  under  test.  Then,  for  those  maneuvers  perceived  to  carry  significant  risk,  dive 
recovery  predictions  and/or  simulator  rehearsals  were  utilized  to  adjust  test  point  conditions  and  determine 
the  minimizing  procedures  necessary  to  control  risk.  The  problem  with  this  methodology  was  not  the  cre¬ 
ation  of  minimizing  procedures,  it  was  the  threshold  for  requiring  additional  planning.  At  the  AFFTC,  there 
were  several  “rules  of  thumb”  that  drove  this  threshold.  First,  basic  operational  rules  for  fighter  aircraft  were 
readily  available  and  routinely  used.  Second,  and  for  all  aircraft,  5,000  feet  AGL  was  seen  as  the  altitude 
below  which  dive  recovery  became  more  critical.  The  implication  was  that  as  long  as  the  recovery  would  be 
completed  above  5,000  ft  AGL,  the  maneuver  was  low  risk. 

These  informal  methods  resulted  in  an  almost  schizophrenic  approach  to  dive  recovery;  they  had  a 
history  of  success  but  little  rational  basis.  For  large  or  low-g  aircraft,  descents  in  excess  of  about  10  degrees 
below  5,000  feet  AGL  often  drove  additional  minimizing  procedures — such  as  simulator  practice  and  a 
buildup  approach  to  the  desired  recovery  altitude — in  spite  of  only  needing  several  hundred  feet  to  recover. 
For  fighter  aircraft,  the  threshold  for  concern  had  less  to  do  with  altitude  (5,000  feet  AGL  was  clearly  too 
low  for  very  steep  high-speed  dives)  and  more  to  do  with  rules-of-thumb  and  pilot  experience.  Reliance 
on  rules-of-thumb  and  intuition  had  resulted  in  a  situation  where  the  F-22  CTF  was  beginning  1.6  MN, 
9  g  “split-s”  flight  test  maneuvers  at  about  25,000  feet  AGL4  (under-conservative)  while  the  C-17  CTF  was 
required  to  build-up  to  20-degree  dives  at  3,000  feet  AGL  (over-conservative). 

Available  Reaction  Time: 


“Available  Reaction  Time”  (ART)  was  a  planning  methodology  developed  for  an  F-16  ground  collision 
avoidance  test  in  the  mid-1990’s.  A  paper  on  the  method  entitled  The  A.R.T.  of  Ground  Collision  Avoidance 
Testing  (reference  3),  was  presented  at  the  1999  Society  of  Experimental  Test  Pilots  Annual  Symposium  by 
LtCol  Bob  Wilson  and  Mike  Seelos. 

The  algorithm  for  the  F-16  GCAS  was  designed  to  prevent  the  aircraft  from  going  beneath  a  pre-selected 
minimum  altitude  above  the  ground.  A  buildup  process  was  conducted  by  artificially  raising  the  surface 
elevation  database — and  consequently  the  minimum  recovery  altitude — so  that  the  automatic  recovery  could 
be  evaluated  without  unnecessarily  endangering  the  pilot  and  aircraft.  Nevertheless,  there  were  clearly 
diving  maneuvers  where  the  expected  minimum  altitude  gave  the  pilot  little  reaction  time  to  correct  a  GCAS 
deficiency.  The  hazard  of  these  maneuvers  increased  as  the  altitude  buffer  was  decreased.  The  GCAS  team 
researched  human  reaction  time  and  used  this  data  to  create  the  risk  ranges  depicted  in  figure  4.5  Figure  5 
depicts  the  graphics  from  the  paper  showing  how  an  altitude  buffer  was  used  to  plan  the  profile  and  ART 

4  It  must  be  noted  that  while  the  maneuver  was  intended  to  be  flown  without  exceeding  about  45-degree  descent  angle,  nobody  was 
particularly  concerned  that  pulling  through  in  a  complete  9-g  “split-s”  maneuver  represented  a  significant  hazard. 

5  Alert  readers  will  have  noticed  the  similarities  between  the  ART  times  and  TSM  times.  The  NASA  F-16  Auto-GCAS  program, 
from  which  some  AFFTC  TSM  boundaries  were  obtained,  built  upon  the  mid-1990’s  GCAS  program  and  used  the  same  risk 
assessment  technique  with  a  few  minor  alterations. 
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was  calculated  to  assess  the  risk. 


The  ART  methodology  was  an  extremely  successful  risk-assessment  technique,  but  it  was  seen  as  only 
that.  Several  quotes  from  the  paper  drive  this  home: 


In  conclusion,  we  believe  A.R.T.  is  an  excellent  normalizing  factor  that  can  be  used  for  any 
given  ground  collision  avoidance  system  test  point  regardless  of  the  system  or  aircraft  under 
test. 

...we  conclude  this  paper  with  the  assertion  that  A.R.T.  is  merely  a  tool  available  for  use  in 
assessing  test  point  risk,  [italics  added] 


The  authors  envisioned  ART  as  a  risk  assessment  method  for  ground  collision  avoidance  system  testing 
when  the  methodology,  in  hindsight,  had  much  broader  potential  as  a  planning  method  for  most  wings-level 
diving  maneuvers. 

The  ART  and  TSM  methods  were  independently  founded  on  the  core  principle  that  the  critical  safety 
parameter  for  dive  recoveries  is  not  altitude,  airspeed,  dive  angle,  or  any  other  indication  provided  in  the 
cockpit;  it  is  the  time  available  for  the  test  team  to  react  to  unplanned  deviations  that  could  result  in  impact 
with  the  ground. 


A.R.T.  (seconds) 

RISK 

greater  than  2,  less  than  or  equal  to  3 

HIGH 

greater  than  3,  less  than  or  equal  to  4 

MEDIUM 

greater  than  4 

LOW 

Figure  4  ART  Risk  Assessment  Requirements  (reference  3) 
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Figure  7  GCAS  Profiles  Summary 
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Abort  Altitude 


Figure  6  Available  Reaction  Time  (A.R.T.) 


Figure  5  ART  Figures  Depicting  Altitude  Buffer  and  Pilot  Reaction  Time  (reference  3) 
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THE  ROLE  OF  INTUITION  IN  PLANNING 


“Intuition”  is  defined  as  “instinctive  knowing  (without  the  use  of  rational  processes)”  by  Princeton  Uni¬ 
versity’s  WordNet  lexical  database  (reference  4).  Intuition  is  a  key  paid  of  airmanship  because  pilots  arc  so 
often  required  to  make  decisions  without  the  time  or  information  for  a  judicious  process.  In  spite  of  the 
confidence  most  people  place  on  their  intuition,  intuition  is  best  treated  with  skepticism.  For  instance,  hu¬ 
man  beings  arc  relatively  adept  at  projecting  linear  conditions  to  predict  spatial  positioning  so  pilots,  being 
human,  tend  to  subconsciously  linearize  most  conditions.  So,  while  the  “on  the  wire”  dive  problem  is  linear 
and  easily  understood,  highly  non-linear  entry  and  recovery  conditions  can  quickly  render  the  pilot’s  intu¬ 
ition  inadequate.  While  valuable  when  properly  developed  and  applied  in  the  correct  context,  intuition  can 
lead  to  confident  and  comfortable  dependence  on  blind  luck.  When  the  F-22  CTF  and  the  AFFTC  examined 
the  circumstances  of  the  2009  F-22  mishap,  the  most  common  reaction  was  surprise:  How  was  it  not  obvious 
that  about  13,000  feet  was  required  for  a  9-g  recovery  from  a  1.6  MN  vertical  dive?  The  intuition  borne  of 
years  of  flying  and  testing  fighter  aircraft  was  clearly  inadequate.  A  rigorous  process  was  needed. 
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DIVE  PLANNING  FACTORS 


There  are  many  factors  to  account  for  when  determining  the  altitude  lost  during  a  dive  recovery.  It  does 
not  help  that  as  the  margin  for  recovery  becomes  smaller  each  factor  gains  importance,  both  alone  and  in 
combination  with  the  others.  Factors  that  arc  inconsequential  at  higher  altitudes  may  make  a  life-or-death 
difference  closer  to  the  ground.  Some  of  the  more  important  planning  factors  arc  altitude,  airspeed,  dive 
angle,  bank  angle,  roll  rate,  recovery  Nz,  Nz  onset  rate,  aircraft  performance,  unique  aircraft  characteristics,6 
and  pilot  skill. 

NORMAL  ACCELERATION  (Nz) 

Recovery  Nz  (traditionally  measured  in  units  of  gravitational  acceleration,  “g”),  is  correctly  understood 
as  a  very  important  dive  recovery  component  but  it  is  not  immediately  apparent  that  as  the  Nz  increases  the 
incremental  effect  of  the  added  Nz  decreases.  Figure  6  depicts  constant  /V,  recoveries  at  0.8  MN  starting 
from  a  vertical  dive  at  the  same  altitude.  Note  that  the  relationship  between  Nz  and  altitude  loss  is  not  linear. 
As  the  /V,  increases,  each  additional  g  added  to  Nz  increases  the  Nz  by  a  smaller  percentage  of  the  total  Nz. 
For  instance,  going  from  2  g  to  3  g  increases  the  Nz  by  50  percent  but  going  from  8  g  to  9  g  only  increases 
the  Nz  by  12.5  percent.  Note  also  that  the  curves  arc  not  circular  arcs;  the  radius  increases  as  the  dive  angle 
decreases.  As  Nz  decreases  gravity  takes  a  higher  toll  at  shallow  dive  angles.  In  a  shallow  dive,  half  of  a 
2-g  pull  is  dedicated  to  opposing  gravity  and  has  no  effect  on  the  radius  of  the  flight  path,  while  in  the  same 
shallow  dive  angle  at  8  g  only  12.5  percent  of  the  pull  is  used  to  counter  gravity.  Neither  of  these  “lessons” 
is  the  least  bit  complex  or  surprising  yet  most  pilots  find  it  hard  to  believe  that  for  these  constant  Mach  and 
Nz  vertical  dive  recoveries,  the  difference  in  altitude  loss  between  2  g  and  3  g  is  within  5  percent  of  the 
difference  in  altitude  loss  between  3  g  and  9  g.7 


6  Characteristics  such  as  high-Mach  RPM  lockup,  delayed  afterburner  cancellation,  N,  limiters,  and  maneuver  load  alleviation 
(including  automatic  speedbrake  retraction)  can  significantly  limit  a  high-speed/Mach  recovery  without  being  evident  to  the  pilot 
during  the  maneuver. 

7  Returning  to  figure  3,  if  a  9-g  pull  is  used  instead  of  the  5-g  pull  depicted,  it  will  still  be  much  less  than  required  for  a  successful 
recovery  at  1.6  MN;  impact  will  occur  in  a  37-degree  descent. 
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TRUE  AIRSPEED  AND  MACH  NUMBER 


True  airspeed  and  Mach  number  arc  closely  related.  Mach  number  (the  ratio  of  the  aircraft  true  airspeed 
to  the  speed  of  sound)  and  the  true  airspeed  tend  to  be  fairly  proportional  thanks  to  the  slow  change  of 
the  speed  of  sound  with  altitude.  An  aircraft  traveling  at  Mach  1  at  50,000  ft  MSL  is  only  moving  about 
13  percent  slower  than  an  aircraft  at  the  speed  of  sound  at  sea  level.  Most  dive  recoveries  take  much  less 
than  50,000  feet  so  we  can  assume  that  the  effect  of  Mach  number  and  true  airspeed  arc  the  same. 

At  a  constant  acceleration,  the  turn  radius  is  proportional  to  the  true  airspeed.  In  the  simplest  case,  the 
instantaneous  wings-level  dive  turn  radius,  r,  is  related  to  Nz  and  dive  angle  (y)  by  the  following  equation, 
where  g  is  the  local  acceleration  due  to  gravity: 


,=  v> 

Nz-g  cos  y 

Nz  is  predominantly  the  ratio  between  the  lift  and  weight  of  the  aircraft  multiplied  by  g. 


„  L  ipVf  CLS 

=  W~ 


By  substituting  the  equation  for  Nz  into  the  turn  radius  equation,  we  find: 
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cos  y) 
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where  cockpit  N ,  =  - in  units  of  g. 

W 

The  effect  of  V,  on  the  instantaneous  turn  radius  is  highly  dependent  on  the  dive  angle  and  the  cockpit 
N-.  If  the  dive  angle  is  very  steep,  cosy  is  approximately  nil  and  the  Vf  terms  cancel  out.  This  means  that 
at  very  steep  dive  angles  the  turn  radius  does  not  change  with  airspeed  so  long  as  the  aircraft  gross  weight 
(W)  and  coefficient  of  lift  (Cl,  approximately  constant  for  a  given  angle-of-attack  (AOA)  in  subsonic  flight) 
arc  the  same.  If  the  dive  angle  is  very  shallow,  cosy  is  approximately  equal  to  1.  If  the  Nz  is  close  to  1  g, 
the  turn  radius  grows  with  the  true  airspeed  but  as  the  Nz  increases,  the  turn  radius  becomes  less  dependent 
on  true  airspeed. 

To  a  pilot  faced  with  a  dive  recovery,  the  airspeed  is  typically  dictated  by  the  situation  so  all  the  pilot 
can  do  is  increase  the  Nz  as  high  as  necessary  (or  possible)  to  affect  a  recovery.  There  must  also  be  enough 
Nz  available  for  recovery.  As  the  dive  shallows,  the  radius  of  the  dive  increases.  In  a  vertical  dive  all  of  the 
N-  is  turning  the  aircraft  but,  as  the  aircraft  approaches  level  flight,  only  Nz  -  lg  is  turning  the  aircraft. 

CALIBRATED  AIRSPEED  AND  DYNAMIC  PRESSURE 


An  aircraft  produces  lift  by  acting  on  the  air  roughly  in  accordance  with  the  two-dimensional  lift  equa¬ 


tion. 


1  2 

L  =  qCiS  where  the  dynamic  pressure  q  =  -pVt 
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Equivalent  airspeed  (EAS)  is  the  airspeed  defined  by  constant  dynamic  pressure,  q.  At  a  given  equivalent 
airspeed,  the  dynamic  pressure  is  the  same  regardless  of  altitude. 

Equivalent  airspeed  and  calibrated  airspeed  (CAS)  are  very  close  for  dive  recovery  considerations. 
(Compressibility  has  little  effect  on  CAS  at  low  altitude).  For  most  aircraft,  the  stall  speed  is  defined  as 
the  first  local  maximum  of  the  coefficient  of  lift.  Cl  as  the  AOA  is  increasing.  At  subsonic  speeds,  this  max¬ 
imum  Cl  at  stall  represents  the  maximum  Nz  available  for  recovery  and  this  maximum  lift  point  is  achieved 
for  a  given  /V,  at  the  same  subsonic  CAS  regardless  of  altitude.  This  marks  the  low  end  of  the  dive  recovery 
airspeed;  if  the  CAS  is  not  above  the  stall  speed,  the  recovery  cannot  be  completed  in  a  conventional  aircraft. 

On  the  high  end  of  CAS,  the  “corner  speed”  creates  another  challenge.  The  corner  speed  is  the  lowest 
speed  at  which  the  aircraft  can  achieve  the  structural  limit  N-.  Above  this  speed,  the  /V,  may  be  increased 
but  only  at  the  cost  of  over-g  and  the  risk  of  structural  damage  or  failure.  If  the  pilot  respects  the  /V,  limit, 
the  turn  radius  increases  rapidly  as  airspeed  increases  above  the  corner  speed. 

Dive  recoveries  are  best  accomplished  in  a  range  of  airspeed  between  too  slow  to  recover  (near  or  below 
the  stall  CAS)  and  so  fast  that  recovery  without  risk  of  structural  damage  (faster  than  the  corner  CAS)  cannot 
be  accomplished  without  significantly  increasing  altitude  loss.  Pilots  arc  typically  trained  to  use  high  power 
settings  for  slow  nose-low  recoveries  and  low  power  settings  (plus  drag  devices,  if  required)  for  high  speed 
nose-low  recoveries  that  might  exceed  the  corner  speed. 

INITIAL  AIRCRAFT  ATTITUDE  AND  RECOVERY  TECHNIQUE 

Aircraft  attitude  and  Nz  at  the  initiation  of  the  recovery  maneuver  bring  in  several  layers  of  complexity. 
At  high  bank  angles,  unloading  to  roll,  rolling  to  an  upright  attitude,  and  pulling  to  the  recovery  Nz  add  to 
the  altitude  loss.  Figure  7  depicts  three  7-g  dive  recoveries  from  a  45-degree  descent  at  0.9  MN.  The  first 
case,  resulting  in  minimum  altitude  loss,  has  the  aircraft  just  continuing  a  7-g  pull.  The  second  case  has 
the  aircraft  starting  at  about  0.7  g  (maintaining  a  constant  flight  path  angle)  and  pulling  to  7  g  at  3  g/sec, 
resulting  in  about  a  50  percent  increase  in  altitude  loss.  The  final  case  has  the  aircraft  inverted  at  7  g,  much 
like  what  might  be  required  in  a  “Split-S”  flight  test  maneuver.  After  unloading  to  1  g  in  2  seconds,  rolling 
upright  at  90  degrees  per  second,  and  pulling  3  g/sec  to  attain  7  g,  the  total  altitude  loss  exceeds  five  times 
the  altitude  loss  of  the  simple  7-g  pull.  The  altitude  loss  is  so  great  that  the  “AGL/100  rule”  is  rendered 
unsafe.  For  steep  dive  angles,  the  altitude  lost  to  unloading  and  rolling  to  a  wings-level  upright  attitude  can 
be  so  great  that  after  pulling  to  an  inverted  dive  of  approximately  70  degrees  at  high  g,  continuing  to  pull 
through  the  vertical  is  usually  the  best  maneuver  to  minimize  altitude  loss. 

AIRCRAFT-SPECIFIC  CONSIDERATIONS 

Every  aircraft  brings  its  own  limitations  to  a  dive  recovery.  Some  limitations  are  immediately  obvi¬ 
ous,  such  as  flight-manual  mandated  Nz  limits  and  the  stall  angle-of-attack.  Pilots  are  intimately  aware  of 
these  limitations  and  should  be  trained  to  apply  them  to  their  dive  recovery  problems.  Aircraft  outfitted 
with  stability  and  control  augmentation  systems  often  have  additional  characteristics  that  may  provide  an 
unexpected  surprise  during  a  high-stakes  dive  recovery. 

Asymmetric  Load  Limitations: 


In  earlier-era  aircraft,  pilot  skill  was  the  sole  method  to  ensure  that  the  asymmetric  load  limit  was 
not  exceeded.  Given  the  complexity  of  aerobatic  flight  and  high-load  combat  maneuvering,  pilots  often 
developed  the  habit  of  unloading  to  trim  (usually  1  g  Nz )  prior  to  making  any  significant  rolling  maneuver. 
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Figure  7  The  Effect  of  Simple  Maneuvers  on  a  0.9  MN 
Dive  Recovery 

During  an  upright  dive  recovery  unloading  to  roll  will  increase  the  altitude  loss,  but  in  an  inverted  dive 
unloading  to  roll  will  typically  decrease  the  altitude  loss.  It  is  likely  that  a  pilot  with  these  habit  patterns  will 
inadvertently  increase  altitude  loss  during  an  upright  dive  recovery.  Many  modern  aircraft  incorporate  flight 
control  systems  that  allow  “carefree  maneuvering.”  With  these  aircraft,  pilots  need  not  be  concerned  about 
asymmetric  over-stress  and  unloading  to  roll  is  unnecessary.  Perhaps  these  pilots  arc  more  likely  to  increase 
altitude  loss  in  a  inverted  dive  by  not  unloading  prior  to  the  roll. 

Flight  Control  System  Limiters: 

The  most  obvious  flight  control  system  (FLCS)  limiters  include  Nz,  roll  rate,  and  angle-of-attack  limits 
imposed  to  allow  the  pilot  to  “max  perform”  the  aircraft  with  minimum  risk  of  over-stress,  departure,  or 
stall.  These  systems  arc  rarely  as  simple  as  they  first  appeal-.  For  instance,  it  is  not  unusual  for  additional  roll 
rate  and  Nz  limits  to  be  imposed  at  higher  angles-of-attack.  Dive  recoveries  must  be  planned  within  these 
additional  limits  to  prevent  excess  altitude  loss  that  can  occur  from  achieving  less-than-expected  roll  rates 
or  Nz. 

Load  Alleviation  Systems: 


Load  alleviation  systems  reduce  the  likelihood  of  over-stress  and  increase  the  expected  lifetime  of  an 
airframe  by  monitoring  critical  points  for  structural  loads  and  limiting  the  aircraft  performance  as  necessary 
to  prevent  exceeding  a  preset  limit.  These  systems  have  produced  unexpected  reductions  in  the  anticipated 
roll  rate  and  Nz,  an  obviously  hazardous  result  during  a  low-margin  dive  recovery. 

Engine  Stability  Augmentation: 

Engines  outfitted  with  stability  and  control  augmentation  systems  can  produce  an  extraordinary  amount 
of  thrust  or  power  with  excellent  reliability  and  “care-free”  operation.  These  characteristics  do  not  come 
without  a  price,  though,  as  pilots  occasionally  discover  when  they  find  that  a  request  for  IDLE  power  is 
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answered  with  full  MILITARY  power  as  the  engine  does  what  it  must  to  continue  stall-free  operation.  An 
engine  can  produce  more — or  less — thrust  than  expected  as  it  runs  its  program  to  maintain  stability  across  a 
large  aircraft  envelope.  An  unexpectedly  high  power  setting  can  significantly  increase  the  altitude  lost  in  a 
dive  recovery  at  maximum  Nz. 
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TIME  SAFETY  MARGIN 


THE  DEVELOPMENT  OF  TIME  SAFETY  MARGIN 

The  tragic  loss  of  Mr.  Cooley  and  his  F-22  at  the  AFFTC  in  2009  showed  that  the  dive  recovery  planning 
methods  used  with  confidence  and  apparent  success  for  years  could  not  be  fully  trusted.  As  conservative 
planning  requirements  were  put  in  place  across  the  AFFTC,  the  F-22  CTF  was  tasked  with  developing  a  new 
approach  toward  accomplishing  their  -Ps  testing.  This  approach  would  have  to  account  for  all  elements  of 
the  dive  planning  problem.  The  CTF  was  also  directed  to  ensure  that,  as  a  minimum,  all  diving  test  points 
had  defined  planned  and  abort  dive  angles,  planned  and  abort  recovery  altitudes,  and  standard  procedures  to 
be  used  when  executing  either  the  planned  dive  recovery  or  abort  dive  recovery.  While  developing  this  new 
approach,  CTF  members  developed  “Time  to  Impact  (TTI)”  as  a  means  of  assessing  risk.  Their  approach — 
formalized  in  the  test  and  safety  planning  change  required  to  continue  the  mishap  test  points — was  then 
independently  evaluated  by  an  AFFTC  Safety  Review  Board  (SRB).  The  SRB  recommended  that  the  CTF 
subtract  from  TTI  the  time  beyond  which  recovery  was  not  possible.  The  F-22  CTF  incorporated  this 
recommendation  and  calculated  a  “Time  to  Unrecoverable  (TTU)”  for  each  maneuver.  In  order  to  capture 
the  most  conservative  TTU,  the  worst-case  conditions  on  the  test  point  were  used  as  the  stalling  conditions 
(highest  speed,  lowest  altitude,  steepest  dive,  etc.). 

With  a  solution  in  place  for  the  F-22,  the  AFFTC  turned  to  dive  planning  in  general,  the  AFFTC 
Dive  Safety  Working  Group  was  formed  to  develop  a  broadly-applicable  method  for  dive  safety  planning. 
As  it  was  about  to  assemble  for  the  first  time,  email  traffic  between  members  grew  as  they  shared  their 
organizations'  methods  and  thoughts.  All  of  these  methods  had  a  common  simplification;  they  focused  on 
the  2-dimensional  problem  of  diving  wings-level  flight.  The  working  group  needed  to  find  a  method  that  was 
comprehensive  enough  to  be  suitable  for  a  wide  variety  of  aircraft  and  missions,  ranging  from  USAF  Test 
Pilot  School  students  flying  single-look  qualitative  evaluation  sorties  in  small  aerobatic  aircraft,  to  bomber 
aircraft  testing  emergency  descents,  to  transport  aircraft  conducting  ground  proximity  warning  tests,  and  to 
fighters  at  very  high  Mach  numbers  and  steep  dives.  A  method  was  needed  that  allowed  for  planning  for 
complex  3-dimensional  maneuvers  such  as  wind-up  turns  and  slice-backs. 

In  the  hope  of  seeing  the  problem  more  clearly,  the  author  wrote  a  software  tool  that  allowed  examination 
of  the  problem  with  all  critical  aircraft-independent  factors  taken  into  account.8  Running  multiple  examples 
confirmed  that  the  problem  was  not  sufficiently  accounted-for  by  any  of  the  rules-of-thumb  or  aircraft- 
specific  methods.  Nevertheless,  several  things  became  clear.  First,  every  dive  recovery  had  a  point  that  best 
encapsulated  the  severity  of  the  dive;  the  lowest  AGL  altitude  of  the  steepest  dive  angle  of  the  maneuver — the 
“worst-case  vector.”  Second,  every  unsuccessful  dive  recovery  had  a  point  where  impact  with  the  ground 
was  inevitable,  obviating  the  need  to  consider  risk  reduction  measures  after  that  point  and  clarifying  the 
necessity  of  never  getting  there.  Finally,  as  the  maneuver  was  started  at  lower  and  lower  altitudes,  one  thing 
varied  in  a  very  straightforward  and  essentially  linear  way — the  time  that  the  aircraft  could  remain  on  the 
worst-case  vector  until  the  planned  recovery  would  become  insufficient  to  complete  a  recovery.  The  author 
named  that  time  “Time  Safety  Margin”. 

With  TSM  as  a  common  metric  for  all  dive  recoveries,  it  was  immediately  apparent  that  general  cat¬ 
egories  divided  by  specific  TSM  values  could  be  used  to  characterize  the  risk  of  a  maneuver  and,  con¬ 
sequently,  the  type  and  amount  of  mitigation  required  to  ensure  safe  recovery.  But  where  to  draw  these 
boundaries?  Boundaries  at  4  seconds  (medium  risk),  2.5  seconds  (high  risk),  and  1.5  seconds  (exceptionally 

8  A  more  user-friendly  graphical  user  interface  version  of  this  tool,  the  “Time  Safety  Margin  Awareness  Tool”  written  for  MATLAB 
and  documented  in  appendix  C,  is  freely  available.  This  tool  was  used  for  the  examples  in  this  handbook. 
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high  risk)  were  taken  from  the  ART  risk  assessment  method  that  had  grown  with  the  NAS  A/USAF  automatic 
ground  collision  avoidance  flight  tests.  These  boundaries  were  based  on  pilot  reaction  time — a  valid  way 
of  thinking  about  TSM:  “How  much  time  can  the  recovery  be  delayed  at  the  worst  conditions?”  Although 
a  ten  second  boundary  for  “routine”  recoveries  was  initially  considered,  examination  of  several  real-world 
training  programs  revealed  that  8  seconds  was  a  more  reasonable  value. 

The  author  proposed  TSM  to  the  Dive  Safety  Working  Group  and  they  quickly  agreed  to  pursue  it  as 
the  basis  for  a  generalized  risk  mitigation  methodology  for  diving  maneuvers.  The  final  definition  and 
approach — as  incorporated  into  AFFTC  instructions  in  2009 — nicely  encapsulates  the  important  issues  in 
the  computation  and  use  of  TSM  and  is  presented  later  in  this  handbook.9 

Time  Safety  Margin  is  a  time-based  parameter  calculated  for  a  given  maneuver,  it  is  not  the  regulatory 
framework  built  around  the  parameter;  the  regulatory  framework  should  be  developed  to  meet  the  needs  of 
the  organization  using  TSM. 

THE  DEFINITION  OF  TIME  SAFETY  MARGIN 

Time  Safety  Margin  is  designed  to  provide  a  measurement  of  safety  margin  to  an  entire  test  maneuver, 
beginning  at  the  start  of  the  test  procedure  and  ending  at  the  completion  of  the  dive  recovery.  The  term 
“procedure”  refers  to  the  intended  test  procedure  and  the  term  “recovery”  refers  to  the  recovery  to  level 
flight  following  the  completion  of  the  procedure.  Figure  8  depicts  these  terms  in  a  simple  constant-angle 
dive  entered  using  a  push-over  from  level  flight. 

•  “Procedure  start” — The  starting  point  of  the  maneuver.  Although  it  is  reasonable  to  assume  that  this 
point  coincides  with  the  “cleared  to  maneuver”  call,  room  must  be  left  for  ambiguity;  it  is  possible 
for  the  setup  for  the  test  procedure  to  include  a  more-hazardous  dive  than  the  procedure  itself.  In  this 
case,  the  procedure  should  include  the  setup. 

•  “Procedure” — The  flight  path  from  the  start  of  the  procedure  to  the  start  of  the  recovery. 

•  “Planned  recovery  start” — The  point  at  which  the  procedure  is  completed  and  recovery  is  initiated 
including  planned  test  team  and/or  pilot  reaction  time.  This  may  follow  the  successful  completion  of 
the  test  point/procedure,  the  decision  to  recover  in  lieu  of  pursuing  a  failing  attempt  (typically  called  a 
“termination”),  or  the  decision  to  recover  as  preset  limits  arc  exceeded  (typically  called  an  “abort”).10 

•  “Recovery  end” — The  completion  of  the  recovery  on  a  vector  that  assures  ground  clearance;  typically 
level  flight. 

•  “Maneuver” — The  entire  planned  event  from  the  beginning  of  the  procedure  to  the  completion  of  the 
recovery. 

The  rest  of  the  terms  arc  needed  to  define  TSM. 

•  “Worst-case  vector” — The  point  during  the  maneuver  where  the  aircraft  is  at  the  lowest  altitude  for 
the  fastest  descent  rate.  This  point  should  be  determined  by  assuming  that  the  entire  maneuver  is 
executed  using  the  least-conservative  allowable  conditions. 

•  “TSM  path” — A  straight-line  flight  path  connecting  the  worst-case  vector  with  the  start  of  the  contin¬ 
ued  maneuver.  TSM  is  the  time  the  aircraft  spends  on  this  flight  path.  Aircraft  performance  should 

9  In  the  intervening  years,  the  regulatory  guidance  has  become  slightly  more  generalized,  somewhat  more  restrictive  (TSM  less 
than  1.5  seconds  is  not  allowed),  and  elevated  to  the  Major  Command  level. 

10  Late  recognition  of  exceeding  the  abort  parameters  would  result  in  an  unplanned  reduction  in  the  TSM  and  would  be  cause  for 
an  immediate  safety-of-flight  recovery  (typically  signified  with  a  “knock-it-off”  call). 
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be  considered  to  adjust  the  airspeed  of  the  aircraft  on  the  TSM  path,  but  the  path  itself  is  entirely 
described  by  the  direction  the  aircraft  is  moving  at  the  worst-case  vector. 

•  “Continued  maneuver” — The  worst-case  planned  maneuver  is  continued  from  the  conditions  of  the 
worst-case  vector  except  at  the  altitude  and  airspeed  calculated  for  the  end  of  the  TSM  path. 


The  Simplest  Definition  of  TSM: 

Time  Safety  Margin  is  the  time  to  directly  travel  from  the  worst-case  vector  to  an  unrecoverable  condi¬ 
tion.  It  is  estimated  by  first  defining  a  least-conservative  combination  of  procedure  and  dive  recovery,  then 
by  identifying  the  resulting  worst-case  vector  in  the  resulting  maneuver  (which  may  be  in  either  the  proce¬ 
dure  or  the  recovery),  and  finally  by  finding  the  longest  amount  of  time  that  the  aircraft  can  spend  on  the 
path  described  by  the  worst-case  vector  before  continuing  the  maneuver  would  not  result  in  ground  impact. 

THE  ORIGINAL  TSM  REQUIREMENTS 

After  working  through  the  many  implications  and  practicalities  of  deploying  TSM  at  the  AFFTC,  official 
guidance  for  TSM  was  published  in  a  supplement  to  the  Air  Force  Instruction  (AFI)  for  flight  test  operations. 
The  original  guidance  has  been  adjusted  somewhat  over  the  years,  including  eventual  incorporation  into  the 
AFIs  so  that  it  became  required  practice  for  all  USAF  flight  test  operations.  Only  the  original  requirements 
are  presented  here;  it  is  the  responsibility  of  USAF  readers  to  comply  with  current  requirements.  This 
guidance,  provided  in  the  2009  AFFTC  Supplement  1  to  AFI  11-2FT  Volume  3,  Flight  Test  Operations 
Procedures  (reference  5)  read  in  paid: 

For  all  test  points  that  require  or  result  in  a  dive  (gamma  less  than  0  degrees)  and  are  not 
operationally  published  maneuvers. . . ,  test  teams  will  use  the  procedures  outlined  in  [figure  9] 
to  minimize  the  risk  of  controlled  flight  into  terrain  (CFIT).  Dive  recovery  planning  and  safety 
review  board  (SRB)  requirements  will  be  dependent  upon  the  Time  Safety  Margin  (TSM).  TSM 
is  defined  as  the  time  in  seconds  to  directly  travel  from  the  worst  case  vector  (i.e.  worst  case 
combination  of  parameters:  dive  angle,  attitude,  airspeed,  and  available  Nz  that  includes  both 
planned  and  maximum  allowed  deviation/tolerance)  to  an  unrecoverable  condition. 

11  See  appendix  B  for  the  draft  requirements  for  AFI  1 1-2FTV3  as  of  July  2016. 
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With  TSM  as  a  single  parameter  applicable  to  all  dive  recoveries,  requirements  could  be  set  according 
to  TSM.  These  requirements,  depicted  in  figure  9,  were  divided  into  five  categories,  increasing  in  assumed 
risk  and  planning  requirements  as  the  TSM  decreases  from  8  seconds,  the  minimum  for  “routine”  dive 
recovery,  to  0  seconds,  where  assumed  risk  and  required  planning  reach  their  necessary  maximum.  The 
table  and  notes  were  created  in  coordination  with  members  of  the  Dive  Safety  Working  Group  and  AFFTC 
leadership.  Although  specific  to  the  AFFTC  at  the  time,  the  table  contains  some  valuable  considerations. 


Routine 
(TSM  >8) 

Focused 
(8  >  TSM  >4) 

Aided 

(4  >  TSM  >2.5) 

Redundantly  Aided 
(2.5  >  TSM>  1.5) 

Automatic 
(1.5  >  TSM  >0) 

Minimum 

Planning 

Fidelity1 

Flight 

Manual 

M&S 

Best  available 
M&S 

Best  available 
M&S 

Best  available 
M&S 

Recovery 

Procedure1'2 

Routine3 

Defined  and 
Documented4 

Defined  and 
Documented4 

Defined  and 
Documented4 

Automatic4 

Minimum 

Training/Buildup5 

Not 

Required 

In-Flight 

Buildup 

Sim  Rehearsal6  & 
In-Flight  Buildup 

Sim  Rehearsal6'7  & 
In-Flight  Buildup 

Sim  Rehearsal6,7  & 
In-Flight  Buildup 

Recovery 

Initiation8 

Pilot 

Pilot 

Back-up  for  Pilot5 

Two  back-ups  for 
Pilot10 

Automatic 

Presumed  Risk 
Assessment 

Low 

Low 

Medium 

High 

High11 

Notes: 

1.  SRB  will  validate  both  the  dive  planning  modeling  and  simulation  (M&S)  and  the  planned 
recovery  procedure  for  all  recoveries  other  than  routine. 

2.  The  recovery  procedure  will  be  planned  not  to  exceed  80%  of  available  aircraft  limits  at 
flight  conditions  and  to  minimize  any  combination  of  high-g,  g  dwell  time,  high-g  onset,  and 
rapid  transition  from  negative  to  positive  g. 

3.  Immediately  initiate  recovery  after  test  point  is  complete. 

4.  Test  team  will  document  the  planned  test  parameters,  abort  parameters  and  recovery 

5.  In-flight  buildup  maneuvers  will  be  accomplished  with  a  minimum  computed  TSM  of  8 
seconds.  Test  teams  will  validate  predictions  via  buildup  points  before  proceeding  to  test 
points.” 

6.  Simulator  rehearsal  requirements  will  include  practicing  the  complete  recoveiy  procedure. 
SRB  simulator  rehearsal  requirements  may  be  waived  on  a  case  by  case  basis  by  the  test 
safety  package  approval  authority. 

7.  Currency  for  the  pilot  flying  the  maneuver  and  critical  test  team  members  will  be  determined 
by  SRB,  but  no  longer  than  6  days  for  TSMs  less  than  2.5  seconds. 

8.  All  available  onboard  altitude  awareness  devices  will  be  briefed  and  used. 

9.  The  recovery  initiation  back-up  may  be  provided  by  an  on-board  safety  crewmember,  a  chase 
aircrew,  or  control  room  personnel. 

10.  At  least  one  of  the  two  recovery  initiation  back-ups  must  be  external  to  the  test  aircraft. 

11.  Fluman  action  (i.e.  “abort”  calls,  pilot  input,  etc.)  may  not  be  considered  “risk  mitigating.” 


Figure  9  AFFTC  TSM  Planning  Matrix  and  Notes  (reference  5) 


TSM  Time  Range  Requirements: 

The  time  range  requirements  were  created  to  provide  initial  guidance  on  how  TSM  should  affect  the  level 
of  planning,  effort,  and  risk  for  a  particular  diving  maneuver.  The  time  ranges  are  necessarily  stair-stepped, 
much  like  a  risk-assessment  matrix  from  systems  safety  methods,  but  the  actual  change  in  risk  and  required 
planning  effort  is  more  like  a  smooth  curve.  This  curve  approaches  zero  cost  and  risk  at  very  high  TSM 
and  asymptotically  approaches  an  unachievable  maximum  of  cost  and  risk  at  0  seconds  of  TSM.  Thanks  to 
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the  additional  cost  created  by  higher  risk  assessments,  metrics  like  these  will  drive  test  teams  to  design  to  a 
pre-determined  minimum  TSM.  It  is  helpful  to  keep  in  mind  that  the  actual  safety  risk  between,  say,  8. 1  and 
7.9  seconds  of  TSM  is  probably  inconsequential. 

Routine  (TSM>8  Seconds). 


If  the  TSM  is  8  seconds  or  more,  the  maneuver  is  considered  “routine”  in  the  sense  that  a  routinely 
qualified  pilot  can  be  trusted  to  safely  recover  using  routine  planning  and  recovery  procedures,  and  no 
further  safety  mitigation  is  required.  Operationally  representative  maneuvers  that  typically  have  8  seconds 
or  more  TSM  include  instrument  descents  and  subsonic  aerobatics  with  a  5, 000-foot- AGL  floor. 

Focused  (8>TSM>4  Seconds). 


“Focused”  TSM,  although  still  considered  to  present  a  low  risk  of  ground  impact,  requires  the  pilot  to 
have  additional  training  and  the  test  team  to  conduct  additional  planning.  Inflight  buildup  is  also  required  to 
verify  predictions  and  provide  the  test  team  with  the  opportunity  to  practice.  Operational  maneuvers  with 
this  much  TSM  may  include  diving  weapons  deliveries,  simulated  flameout  landings,  and  other  maneuvers 
that  require  additional  training  and  a  specialized  qualification. 

Aided  (4>TSM>2.5  Seconds). 


When  the  pilot’s  reaction  time  becomes  a  factor  for  safe  recovery,  it  becomes  necessary  to  provide  as¬ 
surance  that  a  recovery  command  is  given.  In  addition  to  a  redundant  recovery  call,  “Aided”  TSM  requires 
use  of  the  “best  available”  modeling  and  simulation,  and  rehearsal  in  a  suitable  simulator.  There  arc  oper¬ 
ational  maneuvers  that  fall  in  this  category  but,  as  in  the  case  of  some  weapons  deliveries,  they  tend  to  be 
seen  during  particularly  aggressive  maneuvers.  Maneuvers  with  TSM  in  this  range  arc  initially  assessed  as 
“medium  risk,”  requiring  additional  review  and  oversight.12 

Redundantly  Aided  (2.5>TSM>1.5  Seconds). 


When  TSM  is  2.5  seconds  or  less,  any  delay  in  recovery  can  be  critical,  so  an  additional  back-up  source 
for  the  “recover”  decision  is  required.  Operational  maneuvers  in  this  range  are  rare,  but  include  low-angle 
strafe  attacks.  Airshow  maneuvers  tend  to  fall  in  this  category  as  well.  Both  of  these  examples  require 
an  immense  amount  of  training  and  practice,  usually  with  a  radio-capable  ground  observer  and  methodical 
buildup  practice  sessions.  At  the  AFFTC,  these  test  points  are  initially  assessed  as  “high  risk,”  requiring  the 
most  extensive  review  and  oversight. 

Automatic  Recovery  (1.5>TSM>0  Seconds). 


At  some  point  the  human  pilot  should  not  be  trusted  to  safely  recover  without  an  extraordinary  amount  of 
training  and  its  attendant  cost,  regardless  of  mitigating  procedures  and  external  support.  There  arc  airshow 
maneuvers  and  worst-case  low-angle  strafing  attacks  that  fit  within  this  TSM  range,  but  the  risks  of  accepting 
this  almost  insubstantial  margin  drive  training  costs  and  residual  risk  to  unacceptable  levels  for  most  flight 
test  maneuvers.  The  recovery  system  must  be  fully  tested  prior  to  proceeding  to  these  points  and  these  points 
arc  clearly  “high  risk.” 

12  As  part  of  an  effort  to  examine  TSM  boundaries,  several  in-compliance  weapons  delivery  patterns  were  flown  with  qualified 
fighter  pilots  in  the  front  seat  of  a  T-38.  In  all  cases,  4  seconds  of  TSM  resulted  in  discomfort  and  no  pilot  flew  to  less  than  3 
seconds  of  TSM  without  recovering  earlier  than  planned. 
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Exception  for  Operational  Maneuvers: 


In  the  USAF  Material  Command,  TSM  does  not  apply  to  “operationally  published  maneuvers”  flown  in 
accordance  with  routine  procedures.  Nevertheless,  it  remains  a  valuable  tool  for  understanding  the  risk  of 
those  maneuvers  and  has  been  applied  to  some  routine  maneuvers  to  help  pilots  conceptualize  their  margin 
for  error. 

TSM  AND  DIVE  PLANNING  CONSIDERATIONS 

Let’s  examine  how  TSM  consolidates  the  dive  risk  assessment  problem  and  provides  for  increased  clarity 
and  efficiency.  The  examples  of  figure  3,  6,  and  7  may  be  adjusted  to  determine  the  minimum  dive  recovery 
initiation  altitude  required  for  each  maneuver  to  have  the  same  TSM-measured  risk.  (Each  recovery  in  the 
examples  was  adjusted  to  provide  a  constant  Mach  TSM  of  8  seconds.) 

The  application  of  TSM  to  the  three  dives  of  figure  3  is 
depicted  in  figure  10  (for  comparison,  the  AGL/100  results 
arc  depicted  to-scale  in  the  lower  right-hand  corner  of  the 
figure.  For  these  dives,  the  worst-case  vector  is  90  degrees, 
resulting  in  a  vertical  velocity  of  approximately  1,600  ft/sec, 

900  ft/sec,  and  320  ft/sec  for  the  1.6M,  0.9M,  and  180  KCAS 
dives  respectively.  Eight  seconds  of  TSM  is  provided  for 
these  recoveries  by  planning  for  the  recovery  to  begin  at  an 
altitude  from  which  the  aircraft  can  continue  the  initial  ver¬ 
tical  velocity  for  8  seconds  before  reaching  the  minimum  al¬ 
titude  for  a  successful  (if  barely)  5-g  recovery.13  These  three 
dives  now  have  something  in  common — the  amount  of  time 
that  the  pilot  can  pause  at  the  worst  condition  without  plac¬ 
ing  the  aircraft  into  an  unrecoverable  condition.  The  TSM 
method  solves  the  problem  of  over-conservatism  for  slow, 
high  Ab-capable  aircraft  and  dangerous  under-conservatism 
for  high-Mach  aircraft.  Under  AFFTC  TSM  guidance,  the 
180  KCAS  aircraft  may  now  operate  “routinely”  at  less  than 
5,000  feet  AGL  while  the  1.6  MN  aircraft  must  complete  a 
“routine”  vertical  dive  recovery  above  15,000  feet  AGL.  (For 
the  AGL/100  recoveries,  the  0.9  MN  dive  has  a  very  haz¬ 
ardous  TSM  of  just  2.1  seconds,  the  1.6  MN  dive  is  defini¬ 
tively  unsafe,  and  the  TSM  for  the  1 80  KCAS  recovery  is  an 
extremely  conservative  23  seconds.)  Altitude  at  the  completion  of  the  recovery  varies  widely  with  airspeed, 
further  illustrating  how  altitude  margin  is  not  particularly  indicative  of  the  relative  risk. 

Figure  11  shows  the  results  of  applying  an  eight  second  TSM  to  the  0.8  MN  varying  Nz  vertical  dive 
recoveries  depicted  in  figure  6.  This  figure  shows  how  TSM  takes  into  account  that  a  1-g  increase  from 
2  g  is  much  more  important  than  a  1-g  increase  from  8  g;  the  minimum  eight  second  TSM  altitude  changes 
very  little  for  the  high-AO  points.  Application  of  TSM  produces  a  relatively  constant  minimum  altitude  at 
the  completion  of  these  recoveries  because  the  worst-case  dive  angle — and  thus  the  altitude  lost  during  the 
8  seconds — is  the  same  for  each  dive.  Dive  recovery  initiation  must  start  higher  as  recovery  /V,  is  reduced. 

13  In  reality,  of  course,  a  constant-speed  vertical  dive  is  not  likely.  The  assumption  is  used  here  for  simplicity  but  this  assumption 
could  not  be  used  for  calculating  TSM  unless  the  TSM  was  clearly  “routine.” 


Figure  10  Constant  Speed  5-g  Recovery 
Paths  with  8  seconds  of  TSM 
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Ground  Range 

Figure  1 1  The  Effect  of  Nz  on  Dive  Recoveries  with  8  seconds 

of  TSM 

If  we  compare  TSM  to  a  range  of  dive  recovery  altitudes  determined  by  the  venerable  “AGL/100  rule”, 
we  can  see  where  this  rule  is  under-conservative — even  deadly — and  where  it  is  grossly  over-conservative.14 
Table  2  shows  the  TSMs  that  result  from  applying  the  AGL/100  rule  for  a  range  of  Mach  numbers  and  dive 
conditions.  Note  that  the  TSMs  for  the  typical  tighter  low-level  Mach  range  (about  0.6  through  0.9)  arc 
quite  reasonable  for  routine  fighter  operations  with  intensive  training  and  qualifications,  but  at  low  Mach 
numbers  the  AGL/100  rule  is  much  too  conservative  and  at  high  Mach  numbers  use  of  the  AGL/100  rule  is 
dangerous  for  any  dive  angle  and  deadly  for  steep  dive  angles.  Table  3  depicts  the  altitude  for  recovery  that 
would  provide  4  seconds  of  TSM  at  the  same  combinations  of  Mach  number  and  dive  angle  used  in  table  2. 
These  results  make  it  clear  that  there  is  not  a  simple  rule  that  works  for  a  wide  range  of  Mach  numbers  and 
dive  angles. 


Table  2  TSM  for  AGL/100  Rule15 


TSM  for 

AGL/100  rule 

Initial  Altitude  and  Dive  Angle 

4,000  ft  AGL 
-40  deg  y0 

2,000  ft  AGL 
-20  deg  70 

1,000  ft  AGL 
-10  deg  70 

500  ft  AGL 
-5  deg  70 

Mach 

number 

0.3 

16.9 

16.3 

16.4 

16.5 

0.6 

6.7 

7.1 

7.5 

7.8 

0.9 

2.7 

3.7 

4.3 

4.7 

1.2 

0.2 

1.8 

2.7 

3.1 

1.5 

-1.9 

0.4 

1.6 

2.2 

14  Regardless  of  airspeed,  the  maximum  allowable  dive  angle  is  determined  by  dividing  the  current  AGL  altitude  by  100  (so  at 
2,000  ft  AGL  the  max  dive  angle  would  be  20  degrees) 
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Table  3  Altitude  Required  for  4  seconds  of  TSM16 


Altitude  for  4 
seconds  of  TSM  (ft) 

Initial  Dive  Angle 

-40  deg  y0 

-20  deg  y0 

-10  deg  y0 

-5  deg  y0 

Mach 

Number 

0.3 

1,230 

590 

280 

130 

0.6 

2,860 

1,290 

600 

280 

0.9 

4,860 

2,100 

940 

440 

1.2 

7,230 

3,010 

1,310 

600 

1.5 

9,950 

4,020 

1,710 

770 

Since  TSM  is  determined  using  the  worst-case  vector,  it  is  also  use¬ 
ful  for  complex  maneuvers.  Figure  7  depicted  the  effect  of  unloading  to 
roll  upright  from  an  inverted  7-g  pull  as  compared  to  a  recovery  from 
the  same  dive  angle  with  the  aircraft  already  upright.  As  the  aircraft  is 
unloaded  while  inverted — and  for  much  of  the  1-g  roll — the  dive  angle 
continues  to  increase.  Thus  TSM  for  the  inverted  case  is  based  on  a 
steeper  dive  angle,  requiring  a  significantly  greater  altitude  margin  to 
have  the  desired  TSM  for  the  maneuver.  Figure  12  depicts  the  same 
recoveries  as  figure  7,  but  with  8  seconds  of  TSM  for  each  maneuver. 
As  with  earlier  examples,  the  increased  vertical  velocity  results  in  a 
higher  altitude  at  the  completion  of  the  recovery,  but  this  higher  alti¬ 
tude  is  a  result  of  having  the  desired  safety  margin  for  the  worst-case 
error  during  the  maneuver. 

For  simplicity’s  sake,  all  of  these  examples  assume  constant  Mach. 
During  an  actual  dive  recovery,  the  Mach  might  change  drastically.  If 
the  TSM  is  in  the  “routine”  range  of  at  least  8  seconds,  it  is  improba¬ 
ble  that  changing  airspeed  will  significantly  increase  the  risk  of  CFIT. 
When  TSM  is  less  than  routine,  use  of  the  appropriate  modeling  and 
simulation — or  at  least  in-flight  buildup — will  provide  the  fidelity  nec¬ 
essary  to  understand  the  effect  of  any  airspeed  changes. 


Figure  12  The  Effect  of  Simple 
Maneuvers  on  TSM,  Normalized 
to  8  seconds  of  TSM 


SENSITIVITY  OF  TSM  TO  INITIAL  CONDITIONS  AND  RECOVERY  DEVIATIONS 


The  validity  of  TSM  is  obviously  dependent  upon  how  accurately  the  recovery  is  flown.  Pilots  can  be 
late  to  recover,  roll  too  slowly,  use  reduced  Nz,  misinterpret  the  vertical,  set  the  wrong  power,  or  any  number 
of  other  errors.  Paid  of  TSM  planning  is  understanding  the  sensitivity  of  TSM  to  deviations  from  the  planned 
entry  conditions  and  recovery  method.  This  information  is  invaluable  when  deciding  where  to  focus  during 
the  maneuver,  whether  in  the  aircraft  or  in  a  control  room. 

In  order  to  examine  the  sensitivity  of  TSM  to  deviations  from  the  planned  recovery  maneuver,  it  helps 
to  define  a  “standard”  recovery  maneuver.  The  vast  majority  of  dive  recoveries  staid  with  an  initial  condition 

15  For  the  sake  of  simplicity  and  completeness,  the  specifications  for  a  particular  maneuver  that  are  constant  will  be  given  in  a 
footnote.  For  this  table:  -yo  =  [variable],  </> o  =  0  deg,  ho  =  [variable],  Nz0  =  [as  required  for  constant  dive  angle].  Mo  =  [variable], 
tj  =  0  sec,  N,  =  3  g/sec,  NZr  =  5  g,  hs  =0  feet  MSL,  constant  Mach 

16  -yo  =  [variable],  (f>o  =  0  deg,  ho  =  [variable],  Nz0  =  [as  required  for  constant  dive  angle].  Mo  =  [variable],  tj  =  0  sec, 
Nz  =  3  g/sec,  NZr  =  5  g ,  hs  =0  feet  MSL,  constant  Mach 
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defined  by  the  aircraft  attitude,  altitude,  airspeed,  power  setting,  and  Nz.  We  will  assume  that  the  only 
rotational  rates  on  the  aircraft  arc  from  the  Nz  and  the  action  of  gravity  and  that  there  is  no  roll  rate  or  yaw 
rate  at  the  moment  the  recovery  is  initiated.  From  the  initial  condition  we  will  assume  that  some  delay 
is  possible  with  no  pilot  input  to  change  the  aircraft  state.  Following  that  delay,  the  pilot  will  recover  by 
1)  unloading  to  achieve  an  Nz  suitable  for  rolling,  2)  rolling  to  level  the  wings  with  a  dive  angle  of  less 
than  90  degrees  (“rolling  to  the  nearest  horizon”),  3)  pulling  to  the  planned  recovery  Nz,  and  4)  holding 
that  N-  until  the  aircraft  is  no  longer  descending.  The  pilot  may  also  adjust  the  power  during  the  recovery. 
Obviously,  there  arc  far  more  factors  than  these  that  will  affect  the  dive  recovery,  but  they  arc  usually 
much  less  important.  Let’s  look  at  the  specifics  elements  of  this  dive  recovery  algorithm  one-by-one  while 
assuming  that  the  rest  arc  held  constant. 

Initial  Altitude: 


The  effect  of  altitude  deviations  from  the  planned  minimum  recovery  altitude  arc  very  straightforward. 
Time  Safety  Margin  is  defined  by  the  worst-case  vector  during  the  dive  recovery.  This  vector  has  a  vertical 
velocity  component,  so  in  a  constant-airspeed  dive  recovery  we  can  quickly  calculate  the  effect  on  TSM 
caused  by  an  altitude  deviation  by  subtracting  the  amount  of  time  it  would  take  to  pass  through  the  deviation 
at  the  worst-case  vector  descent  rate.  For  instance,  if  we  have  a  planned  dive  recovery  with  a  TSM  vector  of 
-45  degrees  at  an  airspeed  of  500  ft/sec,  the  vertical  velocity  component  is  500  sin(-45)  =  -353  ft/sec.  If  the 
dive  recovery  was  begun  700  feet  late  the  planned  TSM  would  be  reduced  by  about  700/353  =  2.0  sec.  Keep 
in  mind  that  the  importance  of  this  change  is  entirely  defined  in  relation  to  the  original  TSM;  a  2  second 
change  to  a  20  second  TSM  is  almost  certainly  inconsequential  but  the  same  change  to  a  2  second  TSM 
could  be  deadly. 

Initial  Dive  Angle: 


It  seems  obvious  that  steeper  dives  will  reduce  TSM.  It  is  not  necessarily  obvious,  though,  that  this  effect 
is  more  pronounced  for  shallow  dives. 

Let’s  consider  two  dives  that  are  flown  10  degrees  too  steep.  For  the  first  dive,  let’s  assume  a  planned 
maximum  dive  angle  of  70  degrees;  a  10-degree  error  that  results  in  a  80-degree  dive  increases  the  descent 
rate  by  a  factor  of  (sin  (80)-sin  (70))/  sin  (70)  =  0.048,  or  about  5  percent.  For  the  second  dive,  let’s  consider 
the  change  in  descent  rate  from  a  5-degree  dive  to  a  15-degree  dive;  it  is  (sin  (15)  -  sin  (5))/  sin  (5)  =  1.97, 
or  about  200  percent.  We  can  look  at  the  effect  on  TSM  by  assuming  that  the  two  nominal  dives  are  set  up 
for  8  seconds  of  TSM  at  0.9  MN  in  a  wings-level  steady  dive  and  that  the  pilot  reaches  6  g  for  the  recovery 
at  3  g/sec.17  In  the  first  case,  the  dive  recovery  initiation  altitude  is  about  12,000  feet  AGL  for  a  70-degree 
dive.  If  you  add  10  degrees  to  that  dive,  the  TSM  decreases  to  6.6  seconds.  In  the  second  case,  the  dive 
recovery  initiation  altitude  is  about  800  feet  AGL  for  a  5-degree  dive.  If  you  add  10  degrees  to  that  dive,  the 
TSM  becomes  a  very  scant  1.4  seconds. 

A  small  error  in  maximum  dive  angle  is  almost  meaningless  in  a  near-vertical  dive.  In  a  shallow  dive 
at  low  TSM,  a  small  error  can  significantly  impact  the  pilot’s  recovery  margin.  As  always,  the  smaller  the 
planned  TSM,  the  more  significant  the  effect  is  for  a  given  deviation. 

Bank  Angle  and  Roll  Rate: 


Bank  angle  and  roll  rate  errors  prior  to  a  dive  recovery  can  increase  the  dive  angle  and  rate  of  descent 
then  delay  the  rotation  of  the  lift  vector  to  the  vertical.  At  90-degrees  angle-of-bank  in  a  shallow  dive, 

17  Constant  Mach  recovery,  sea-level  ground,  no  delay  for  recovery. 
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the  dive  angle  (-7)  is  rapidly  increasing  because  the  aircraft  is  accelerating  toward  the  ground  at  1  g.  For 
instance,  if  a  pilot  rolls  to  90  degrees  of  bank  in  300  KTAS  level  flight  at  1  g,  the  dive  will  initially  steepen 
at  a  little  less  than  4  degrees  per  second.  Table  4  shows  how  true  airspeed  and  bank  angle  affect  the  rate  at 
which  the  dive  angle  will  increase  (dy/dt). 


Table  4  Gamma  Rate  (deg/sec)  Dependency  on  Bank 
Angle  and  Airspeed  at  1  g19 


7  (deg/sec)  at 

70  =  0  deg,  1  g  Nz 

Initial  KTAS 

100 

200 

300 

400 

500 

600 

700 

800 

900 

Initial  Bank 

Angle 

0 

0.0 

0.0 

0.0 

0.0 

0.0 

0.0 

0.0 

0.0 

0.0 

30 

1.5 

0.7 

0.5 

0.4 

0.3 

0.2 

0.2 

0.2 

0.2 

60 

5.4 

2.7 

1.8 

1.4 

1.1 

0.9 

0.8 

0.7 

0.6 

90 

10.9 

5.4 

3.6 

2.7 

2.2 

1.8 

1.6 

1.4 

1.2 

120 

16.3 

8.2 

5.4 

4.1 

3.3 

2.7 

2.3 

2.0 

1.8 

150 

20.3 

10.2 

6.8 

5.1 

4.1 

3.4 

2.9 

2.5 

2.3 

180 

21.8 

10.9 

7.3 

5.4 

4.4 

3.6 

3.1 

2.7 

2.4 

Table  4  seems  to  imply  that  the  slower  an  aircraft  is  flying,  the  more  an  excessive  bank  angle  will  affect 
the  TSM.  While  an  excessive  bank  angle  will  cause  the  descent  angle  to  increase  more  rapidly  at  low  speed, 
the  recovery  /V,  will  reverse  the  resulting  dive  angle  more  quickly  if  everything  else  is  held  constant.  Table  5 
shows  an  example  of  how  TSM  is  almost  insignificantly  affected  by  airspeed  at  a  given  initial  bank  angle. 
Table  5  also  shows  how  rapidly  TSM  changes  for  even  slight  increases  in  bank  angle  around  90  degrees. 


Table  5  An  Example  of  TSM  Dependency  on  Bank  Angle  and 
Airspeed  at  1  g,  500  ft  AGL21 


TSM  at 

70  =  0  degs 

Mach 

0.15 

0.3 

0.45 

0.61 

0.76 

0.91 

1.06 

1.21 

1.36 

Initial 

Bank 

Angle 

0 

N/A 

N/A 

N/A 

N/A 

N/A 

N/A 

N/A 

N/A 

N/A 

30 

>60 

>60 

>60 

>60 

>60 

>60 

>60 

>60 

>60 

60 

>60 

>60 

>60 

>60 

>60 

>60 

>60 

>60 

>60 

90 

40.8 

40.7 

40.7 

40.6 

40.6 

40.6 

40.6 

40.6 

40.6 

120 

18.4 

18.2 

18.1 

18.1 

18.1 

18.1 

18.1 

18.1 

18.1 

150 

9.9 

9.7 

9.6 

9.6 

9.6 

9.6 

9.6 

9.6 

9.6 

180 

6.0 

5.7 

5.6 

5.6 

5.6 

5.5 

5.5 

5.5 

5.5 

The  effect  of  initial  bank  angle  on  TSM  may  not  be  immediately  obvious,  aside  from  how  increasing 
bank  angle  alone  must  decrease  TSM  by  either  increasing  the  dive  angle,  delaying  the  time  to  level  the 
wings,  or  forcing  an  unload  to  roll  to  wings  level.  The  quantity  of  this  effect  is  closely  tied  to  the  intended 
bank  angle.  For  instance,  the  TSM  for  a  wings-level  dive  will  not  change  much  for  small  bank  angle  changes 
but  at  90  degrees  of  bank  a  small  bank  angle  increase  can  have  a  major  effect.  Table  6  shows  an  example  of 
how  quickly  TSM  may  be  changing  for  each  degree  of  bank  angle  change.  For  consistency,  each  condition 

19  -70  =  0  deg,  0 0  =  [variable],  Nz0  =  1  g.  Mo  =  [variable],  constant  Mach 

21  -70  =  0  deg,  </>o  =  [variable],  h0  =  500  feet  MSL,  Nz0  =  1  g,  M0  =  [variable],  tj  =  0  sec,  Nz  =  3  g/sec,  N.^  =  1  g,  0  =  90  deg/sec, 
NZr  =  6  g,  hs  =0  feet  MSL,  constant  Mach 
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of  initial  bank  angle  and  dive  angle  defines  the  start  of  a  recovery  from  a  maneuver  ending  at  4  g  with  8 
seconds  of  TSM.  Note  that  the  worst-case  situation  is  in  a  shallow  dive  at  90  degrees  of  bank,  but  at  either 
a  very  steep  dive  angle  or  very  shallow  bank  angle,  the  TSM  change  is  inconsequential.  Even  in  the  worst 
case  in  this  example,  the  TSM  is  only  decreasing  by  1  second  for  every  10  degrees  of  bank.  This  is  not 
particularly  significant  if  TSM  is  greater  than  8  seconds,  but  could  be  very  problematic  for  low-TSM  dives. 


Table  6  An  Example  of  TSM  Dependency  on  Bank 
Angle  and  Dive  Angle23 


Change  in  TSM  per  degree  bank  angle 
change  (8  sec  TSM  Setup) 

Initial  Dive  Angle  (deg) 

10 

30 

60 

80 

15 

- 

-0.02 

- 

- 

45 

-0.02 

-0.02 

-0.02 

- 

Initial  Bank  Angle  (deg) 

90 

-0.10 

-0.06 

-0.02 

-0.02 

135 

-0.08 

-0.04 

-0.02 

-0.02 

165 

-0.04 

-0.02 

-0.02 

- 

The  effect  of  roll  rate  on  TSM  is  obviously  dependent  upon  the  amount  of  rolling  that  is  required. 
Tables  7  and  8  show  two  examples  of  the  change  in  the  minimum  altitude  to  start  an  8  second  TSM  dive 
recovery  for  a  variety  of  bank  angles  and  roll  rates  when  the  aircraft  is  at  4  g  at  the  start  of  the  recovery. 


Table  7  An  Example  of  TSM  Dependency  on  Roll 
Rate  and  Bank  Angle  for  a  Shallow  Dive25 


Alt  (ft)  req’d  for  8  sec  TSM 
yo  ■  -5  deg,  Mq  -  0.8  MN 

Initial  Bank  Angle  (deg) 

45 

90 

135 

180 

Roll  Rate  (deg/s) 

180 

640 

670 

940 

1,450 

90 

650 

690 

1,240 

2,340 

45 

650 

730 

1,900 

4,360 

30 

650 

770 

2,630 

6,610 

15 

650 

880 

5,200 

13,740 

A  few  things  about  roll  rate  arc  obvious.  First,  the  faster  the  roll  rate,  the  less  the  initial  bank  angle 
matters.  Second,  if  the  initial  bank  angle  is  shallow  the  roll  rate  doesn’t  matter;  the  shallower  the  bank, 
the  less  the  roll  rate  can  affect  the  dive  recovery.  The  tables  demonstrate  how,  as  bank  angle  increases  to 
a  maximum  of  180  degrees  and  the  dive  angle  shallows  (with  initial  positive  Nz),  the  roll  rate  becomes 
increasingly  important.  For  example,  if  90  degrees  per  second  of  roll  rate  is  planned  for  the  conditions  of 
the  shallow  dive  on  table  7  and  the  actual  roll  rate  is  45  degrees  per  second,  the  dive  recovery  altitude  for 
8  seconds  of  TSM  almost  doubles  (from  2,340  feet  to  4,360  feet).28 

23  -jo  =  [variable],  <f>0  =  [variable],  h0  =  [as  required  for  8  sec  TSM],  Nz0  =  4  g,  M0  =  0.8  MN,  td  =  0  sec,  TV-  =  3  g/sec,  TV- ^  =  1  g, 
t/>  =  90  deg/sec,  NZr  =  6  g,  hs  =0  feet  MSL,  constant  Mach 

25  -jo  =  5  deg,  tf>o  =  [variable],  ho  =  [as  required  for  8  sec  TSM],  Nz0  =  4  g,  Mo  =  0.8  MN.  td  =  0  sec,  Nz  =  3  g/sec,  TV-^,  =  1  g, 
</>  =  [variable],  NZr  =  6  g,  hs  =0  feet  MSL,  constant  Mach 

27  -jo  =  70  deg,  </> o  =  [variable],  ho  =  [as  required  for  8  sec  TSM],  Nz0  =  4  g.  Mo  =  0.8  MN,  td  =  0  sec,  TV-  =  3  g/sec,  TV- ^  =  1  g, 
if>  =  [variable],  NZr  =  6  g,  hs  =0  feet  MSL,  constant  Mach 

28  The  reduction  in  roll  rate  needn't  be  caused  by  pilot  error.  Load  alleviation  systems  or  unexpected  aircraft  flying  qualities  can 
unexpectedly  reduce  the  roll  rate.  Needless  to  say,  this  is  not  something  you  want  to  discover  during  the  dive  recovery. 
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Table  8  An  Example  of  TSM  Dependency  on  Roll 
Rate  and  Bank  Angle  for  a  Steep  Dive27 


Alt  (ft)  req’d  for  8  sec  TSM 

Initial  Bank  Angle  (deg) 

yo  =  -70  deg,  Mq  =  0.8  MN 

45 

90 

135 

180 

180 

10,910 

11,330 

12,000 

12,530 

Roll  Rate  (deg/s) 

90 

11,050 

11,640 

12,560 

13,430 

45 

11,330 

12,260 

13,650 

15,200 

30 

11,610 

12, 870 

14,750 

16,940 

15 

12,460 

14,720 

18,000 

22,040 

Bank  angle  and  roll  rate  interact  in  complex  ways  to  affect  TSM.  Roll  rate  is  particularly  problematic 
because  it  is  paid  of  the  recovery,  not  paid  of  the  recovery  decision.  The  most  conservative  approach  is  to 
set  bank  angle  and  roll  rate  limits  that  are  significantly  steeper  or  slower  than  expected.  Any  error,  pilot  or 
otherwise,  would  ideally  tend  toward  shallower  bank  angles  and  faster  roll  rates.  For  instance,  if  an  aircraft 
is  limited  by  the  flight  control  system  to  360-degrees-per-second  roll  rate,  it  would  be  unwise  to  assume  that 
the  pilot  will  achieve  that  roll  rate  during  the  recovery  unless  the  bank  angle  was  so  shallow  it  didn’t  matter; 
any  error  would  result  in  reducing  the  actual  TSM.  Roll  acceleration  must  also  be  considered;  the  time  to 
get  to  the  desired  roll  rate  then  stop  it  will  increase  the  time  to  achieve  wings-level  flight.  Dive  angle,  as 
paid  of  the  recovery  decision,  is  easier  to  set  as  a  limit  but  care  must  still  be  taken  to  ensure  that  the  planned 
maximum  dive  angle  for  recovery  initiation  is  observed. 

Airspeed/Mach  and  Power  Setting: 


If  the  airspeed  at  the  initiation  of  the  recovery  is  different  than  planned,  the  effect  on  the  recovery  depends 
on  several  factors;  sometimes  a  faster  airspeed  will  improve  the  TSM,  sometimes  it  will  reduce  the  TSM. 
The  most  obvious  effect  is  the  one  produced  by  increasing  the  speed  and  descent  rate  at  the  worst-case  vector 
that  defines  TSM.  If  everything  else  is  held  constant,  a  faster  airspeed  will  result  in  reaching  the  minimum 
recovery  altitude  faster  and  produce  a  lower  TSM.  Additionally,  the  airspeed  can  significantly  affect  the  turn 
radius  of  the  aircraft,  thus  changing  the  altitude  lost  during  the  recovery. 

Figure  13  illustrates  the  effect  of  equivalent  airspeed — the  airspeed  equivalent  to  a  constant  dynamic 
pressure — and  dive  angle  on  the  instantaneous  turn  radius  for  a  wings-level  dive  recovery.  The  corner  speed 
marks  the  point  where  the  limit  AOA  provides  the  limit  Nz.  For  this  analysis,  we  will  consider  the  corner 
speed  to  be  the  speed  at  which  the  planned  recovery  Nz  meets  the  lift  limit.  Above  the  corner  speed  the  turn 
radius  is  roughly  the  same  regardless  of  dive  angle,  provided  the  intended  Nz  is  significantly  greater  than 
1  g.  As  the  equivalent  airspeed  slows,  the  turn  radius  increases,  asymptotically  approaching  the  airspeed 
needed  to  maintain  the  Nz  required  to  hold  the  specified  dive  angle  at  the  constant  AOA.  For  level  flight,  the 
aircraft  must  hold  1  g  to  maintain  the  level  flight  path.  The  speed  that  corresponds  to  1  g  at  the  pullout  AOA 
defines  the  asymptote  that  the  turn  radii  approach  from  higher  and  lower  airspeeds.  In  a  60-degree  dive,  the 
aircraft  must  hold  0.5  g  to  maintain  the  dive  angle.  The  airspeed  required  to  maintain  0.5  g  at  the  pullout 
AOA  is  much  less  than  for  1  g,  so  the  asymptote  is  at  a  lower  airspeed.  In  a  vertical  dive  (90-degree  dive) 
the  instantaneous  turn  radius  is  the  same  for  a  given  AOA  regardless  of  airspeed.  For  non-vertical  dives,  the 
airspeed  below  the  asymptote  will  produce  an  Nz  insufficient  to  hold  the  current  dive  angle  so  the  nose  will 
fall;  this  is  signified  by  a  negative  turn  radius. 

The  effect  of  an  airspeed  error  on  the  recovery  conditions  depends  on  the  rest  of  the  recovery  conditions. 
If  the  planned  recovery  airspeed  is  significantly  higher  than  the  corner  airspeed  for  the  planned  g,  recovering 
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Figure  13  The  Effect  of  True  Airspeed  on  a  Constant- AOA/7-g  Limited  Wings-Level  Pull 


at  a  faster  airspeed  than  planned  will  increase  the  turn  radius  and  decrease  the  TSM.  On  the  other  side  of  the 
airspeed  spectrum,  if  the  recovery  is  planned  to  occur  at  an  airspeed  close  to  the  1-g  stall  speed,  decreasing 
the  recovery  speed  will  significantly  increase  the  turn  radius  and  altitude  lost  during  the  recovery  (maybe 
even  making  recovery  at  that  speed  impossible).  This  will  significantly  decrease  the  TSM.  Between  these 
two  extremes,  the  interaction  between  the  TSM  vector  time  and  the  altitude  lost  during  the  dive  recovery 
will  be  highly  dependent  upon  the  specific  characteristics  of  the  aircraft  and  the  planned  recovery  technique. 

With  reduced  TSM,  it  is  important  to  err  on  the  fast  side  for  recoveries  close  to  stall  speed  and  on  the 
slow  side  for  recoveries  above  the  corner  speed;  everything  else  is  dependent  on  the  aircraft  and  the  planned 
recovery. 

Calibrated  and  equivalent  airspeed  are  very  close  for  dive  recovery  computations  where  compressibil¬ 
ity  is  not  a  significant  factor  (altitudes  near  sea  level).  Mach  number,  on  the  other  hand,  increases  for  a 
given  equivalent/calibrated  airspeed  as  the  altitude  increases.  Depending  upon  the  aircraft,  transonic  and 
supersonic  Mach  numbers  can  have  a  significant  effect  on  the  Nz  available  for  dive  recovery;  this  tends  to 
complicate  very  high  speed  dive  recoveries. 

The  primary  effect  of  thrust  setting  is  in  how  it  changes  the  airspeed  during  the  recovery.  There  are 
secondary  effects,  such  as  thrust  vectoring,  that  are  highly  dependent  on  aircraft  type  and  recovery  technique. 
In  general,  though,  a  higher-than-planned  thrust  setting  will  tend  to  decrease  TSM  unless  the  airspeed  is 
close  to  the  stall  speed  at  recovery.  Except  for  slow  speed  recoveries,  it  is  good  practice  to  use  a  low  thrust 
setting  for  recovery.  As  TSM  decreases  below  8  seconds,  it  will  be  important  to  know  the  thrust  setting  that 
will  be  required  and  ensure  that  any  deviations  from  that  setting  are  in  the  safer  direction  so  that  they  will 
increase,  not  decrease,  TSM. 

Engine  thrust  characteristics  are  highly  dependent  on  Mach  number,  altitude,  and  airspeed.  Many  mod¬ 
ern  engines  operate  at  relatively  high  power  settings  when  in  “idle”  power  at  high  airspeed — it  is  not  unusual 
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for  a  modem  fighter  engine  to  be  in  full  military  power  in  supersonic  flight  in  spite  of  having  a  throttle  setting 
below  military  power.  Pulling  the  power  levers  all  the  way  to  minimum  might  not  decrease  the  engine  power 
enough  to  reduce  the  airspeed  in  a  dive.  This  can  cause  significant  additional  altitude  loss  and  reduced  TSM 
if  the  airspeed  is  above  the  corner  speed. 

Aircraft  Configuration  and  Weight: 

Aircraft  configuration  and  gross  weight  can  significantly  affect  a  diving  maneuver,  mostly  by  changing 
the  stall  speed  and  the  corner  speed.  For  instance,  if  a  low-speed  diving  test  point  was  planned  for  a  light¬ 
weight  aircraft  but  mistakenly  flown  in  a  heavy-weight  aircraft,  the  TSM  could  be  dangerously  reduced  or 
dive  recovery  made  entirely  impossible.  Increased  weight  will  increase  the  stall  speed,  decrease  the  corner 
speed,  and  increase  the  turn  radius.  Additional  drag  will  slow  the  recovery  airspeed  if  additional  thrust 
isn’t  available.  If  lifting  devices  (flaps,  slats,  etc.)  arc  planned  for  the  dive  recovery  but  inadvertently  not 
deployed,  dive  recovery  may  be  severely  compromised. 

Configuration  and  gross  weight  may  have  to  be  tightly  controlled  when  planning  for  a  low  TSM.  If  the 
objectives  allow,  it  is  a  good  idea  to  define  allowable  ranges  for  aircraft  weight  and  drag  so  these  parameters 
may  be  adjusted  during  maneuver  planning  to  increase  TSM. 

Cockpit  Nz  and  Nz  Onset  Rate: 

The  most  obvious  effect  that  an  N-  error  will  have  at  the  start  of  the  recovery  will  be  in  the  initial  dive 
angle.  If  the  aircraft  is  upright  (less  than  90-degrees  bank  angle)  excess  Nz  will  decrease  the  dive  angle 
prematurely  and  improve  the  TSM.  Conversely,  an  aircraft  in  inverted  flight  (more  than  90-degrees  bank 
angle),  excess  Nz  will  increase  the  dive  angle  before  the  recovery  and  reduce  the  TSM. 

The  Nz  onset  rate  will  have  roughly  the  same  effect  as  Nz  errors  by  increasing  or  decreasing  the  time 
at  an  unplanned  Nz.  There  might  be  second-order  effects  as  well,  such  as  a  too-slow  reduction  in  Nz  while 
unloading  to  the  Nz  required  for  a  rolling  maneuver.  For  bank  angles  that  arc  causing  the  dive  angle  to 
increase,  anything  that  slows  the  progress  of  the  aircraft  lift  vector  toward  the  zenith  will  decrease  the  TSM. 

Sensitivity  to  Unplanned  Delay  Prior  to  Recovery  Initiation: 

The  sensitivity  to  unplanned  delay  is  almost  entirely  a  function  of  the  descent  rate  and  the  rate  at  which 
the  descent  rate  is  changing  at  the  end  of  the  planned  delay  time.  The  effect  on  TSM  is  much  less  pronounced 
if  the  aircraft  is  pitching  up  (dive  angle  decreasing)  during  the  planned  procedure  than  if  the  aircraft  is 
pitching  down  (dive  angle  increasing). 

Unplanned  delay  is  a  particularly  interesting  error  because  it  is  measured  the  same  way  that  TSM  is; 
it  is  measured  in  time.  Unlike  the  various  conditions  that  define  the  recovery  initiation  point  such  as  dive 
angle,  bank,  and  airspeed,  unplanned  delay  necessarily  occurs  after  the  recovery  should  have  started.  For 
instance,  if  the  dive  angle  exceeds  the  maximum  planned  dive,  the  “Abort!”  call  will  probably  come  before 
the  minimum  altitude.  Unplanned  delay  comes  after  the  planned  point  for  TSM  calculation,  where — if  the 
conditions  arc  such  that  TSM  is  rapidly  decreasing — TSM  will  rapidly  decrease  below  that  expected  for  the 
maneuver,  and  may  even  decrease  to  the  point  that  recovery  is  impossible  in  much  less  time  than  the  planned 
TSM. 

The  most  important  weakness  in  the  original  TSM  methodology  was  the  complete  dependency  on  re¬ 
covery  being  initiated  immediately  upon  the  achievement  of  the  procedure  limitations.  Test  teams  were 
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completely  aware  that  some  maneuvers  could  produce  dangerous  TSMs  if  the  pilot  delayed  recovery  only 
slightly  more  than  planned,  yet  the  only  available  response  was  to  be  especially  diligent  about  ensuring  the 
recovery  started  without  added  delay.  Several  surprises  have  demonstrated  that  this  is  not  enough.  Un¬ 
planned  delay  is  a  risk  element  that  must  be  accounted-for  in  the  TSM  planning.  Delayed  Time  Safety 
Margin  provides  a  numerical  solution  that  allows  for  calculation  of  an  adjusted  TSM  to  account  for  un¬ 
planned  recovery  delay. 

DELAYED  TIME  SAFETY  MARGIN  (DTSM) 

Unplanned  Recovery  Initiation  Delay: 

As  TSM  was  employed  across  AFMC — and  especially  at  the  412  TW  and  AFTC — it  became  apparent 
that  there  were  circumstances  where  TSM  did  not  adequately  capture  the  time  the  test  team  and  test  pilot 
had  available  for  errors.  It  worked  quite  well  for  cases  such  as  steady  wings-level  dives  and  procedures 
that  ended  with  the  dive  angle  remaining  the  same  or  shallowing,  but  TSM  did  not  seem  to  capture  the 
actual  dive  recovery  risk  of  the  procedures  like  a  split-s  or  wind-up  turn  where  the  procedure  ended  while 
the  dive  angle  was  increasing.  For  these  procedures,  if  the  entire  procedure  and  recovery  was  flown  exactly 
as  planned,  the  TSM  made  a  lot  of  sense,  but  if  the  pilot  delayed  the  recovery  by  just  a  second  or  two  the 
TSM  would  rapidly  decrease.  For  instance,  it  is  possible  for  a  split-s  maneuver  with  8  seconds  of  TSM  to 
become  unrecoverable  after  just  a  few  seconds  of  delay  past  the  intended  recovery  initiation  point.  Time 
Safety  Margin  did  not  adequately  address  an  unexpected  delay  in  the  start  of  the  recovery. 

Definition  of  Terms  for  DTSM: 


It  is  a  good  practice  to  include  a  reaction  delay  time  as  paid  of  the  planned  procedure,29  but  exceeding 
the  planned  delay  may  rapidly  reduce  the  TSM  so  the  implications  of  exceeding  the  planned  delay  time 
must  be  understood.  Figure  14  depicts  the  same  flight  path  as  figure  8  (Basic  Dive  Recovery  Terminology), 
but  with  the  addition  of  the  “delayed  procedure”  and  the  “delayed  recovery  staid”  point.  This  potential 
source  of  delay  will  be  very  useful  for  adjusting  TSM  when  the  descent  angle  is  steepening  at  the  end  of  the 
procedure.30 

•  “Unplanned  delay” — The  length  of  time  in  seconds  between  the  expected  recovery  staid  and  the  de¬ 
layed  recovery  staid.  This  time  does  not  include  the  planned  delay  prior  to  the  expected  recovery 
start. 

•  “Delayed  recovery  start” — The  point  at  which  the  recovery  is  actually  started  if  there  is  unplanned 
delay. 

•  “Delayed  procedure” — The  flight  path  of  the  aircraft  during  the  time  between  the  expected  recovery 
start  and  the  delayed  recovery  staid.  This  flight  path  will  typically  continue  the  conditions  of  the 
expected  recovery  staid  point,  including  bank  angle,  Nz,  Nz,  and  so  on. 

As  with  no  unplanned  delay,  the  worst-case  vector  can  occur  at  any  point  during  the  maneuver,  from  the 
staid  of  the  procedure  to  the  end  of  the  recovery.  Figure  15  depicts  a  case  resulting  from  a  split-s  procedure 
where  the  recovery  is  initiated  in  a  steep  inverted  dive.  Note  that  the  worst-case  vector  occurs  after  the  roll  to 
upright;  this  is  significantly  after  the  staid  of  the  delayed  recovery.  In  this  example,  the  continued  maneuver 
only  includes  the  dive  pull-out  after  the  roll  to  upright  is  complete. 

19  The  duration  of  this  delay  would  be  a  function  of  the  means  by  which  the  terminate  or  abort  criteria  are  determined  and  relayed. 
It  might  be  a  few  tenths  of  a  second  when  a  verbal  count-down  is  used  or  a  few  seconds  if  the  test  team  is  likely  to  be  surprised 
by  the  abort  call. 

30  The  section  of  this  report  entitled  “Delayed  Time  Safety  Margin”  deals  with  this  issue  in  depth. 
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Figure  14  Dive  Recovery  Terminology  for  to  a  Wings-Level  Dive  with  Unplanned 

Recovery  Delay 


Figure  15  Dive  Recovery  Where  the  TSM  Vector  Occurs  after  the  Start  of  the 

Recovery 


On  the  other  end  of  the  spectrum,  figure  16  depicts  a  case  where  the  procedure  begins  in  an  inverted 
climb  with  a  split-s  and  continues  through  the  split-s  until  stabilizing  in  an  upright  dive  prior  to  the  expected 
start  of  the  recovery.  Note  that  the  worst-case  vector  occurs  during  the  procedure,  not  the  recovery,  so  the 
TSM  path  is  vertical  and  the  continued  maneuver  includes  about  half  of  the  procedure  and  all  of  the  delayed 
procedure  and  recovery.  In  this  case,  unplanned  delay  will  not  change  the  worst-case  vector. 
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Calculating  DTSM: 

To  understand  the  possibly  hazardous  effect  of  unplanned  delay  past  the  intended  recovery  condition, 
let’s  look  at  a  procedure  that  results  in  a  rapidly  increasing  dive  angle  at  the  expected  recovery  start.  Fig¬ 
ure  17  illustrates  just  such  a  procedure:  a  split-s  maneuver.  The  figure  depicts  the  intended  maneuver  with 
no  unplanned  delay  and  two  examples  of  the  maneuver  with  unplanned  delay.  The  intended  maneuver  is 
an  inverted  pull  from  level  flight  to  a  dive  angle  of  45  degrees.  Upon  reaching  that  dive  angle,  the  pull  is 
relaxed  and  the  aircraft  is  rolled  upright;  the  worst-case  vector  occurs  during  this  roll.  Once  the  wings  arc 
level,  the  recovery  Nz  is  set  and  level  flight  is  quickly  attained.  In  the  figure,  this  path  is  shaded  black,  with 
a  black  circle  labelling  the  expected  recovery  start  with  no  unplanned  delay.  The  red  and  blue  paths,  each 
labeled  with  a  delayed  recovery  start  (1  and  2)  depict  two  examples  of  unplanned  delay  and  the  resulting 
recovery  maneuver.  These  maneuvers  assume  that  the  pilot  will  recover  in  accordance  with  typical  nose-low 
recovery  techniques,  using  the  same  roll  rates,  Nz  rates,  and  recovery  Nz  as  intended  for  the  expected  recov¬ 
ery.  For  the  first  (red)  unplanned  delay,  this  means  a  maneuver  similar  to  the  intended  recovery  maneuver 
but  starting  both  lower  and  steeper.  The  second  (blue)  unplanned  delay  results  in  the  aircraft  being  upright 
when  the  delayed  dive  recovery  is  begun  so  there  is  no  need  to  unload  or  roll  and  the  pilot  just  pulls  to 
the  recovery  Nz.  The  dashed  lines  embedded  in  the  three  maneuvers  represent  the  TSM  paths  along  their 
respective  worst-case  vectors. 

The  effect  on  TSM  of  delaying  the  recovery  is  immediately  clear.  With  no  delay,  the  dive  angle  is 
relatively  shallow  and  the  TSM  path  starts  from  a  higher  altitude.  With  the  first  delay  increment  (the  red 
path),  the  unplanned  delay  steepens  the  worst-case  dive  angle,  reduces  its  altitude,  and  requires  additional 
altitude  for  the  recovery.  The  second  delay  increment  passes  through  the  vertical  during  the  delay  so  the 
worst-case  vector  is  that  vertical  dive.  For  this  maneuver,  additional  delay  rapidly  reduces  the  TSM  until  the 
aircraft  passes  through  the  vertical,  at  which  point  the  TSM  begins  to  increase  slightly. 

The  TSM  paths  arc  gathered  on  the  right  side  of  the  figure  to  allow  easy  comparison  of  their  length. 
Assuming  that  the  true  airspeed  is  constant,  it  is  apparent  that  the  short  delay  from  the  expected  recovery 
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start  to  the  first  delayed  recovery  start  decreased  the  TSM  by  about  70  percent.  Although  the  TSM  increased 
a  bit  with  when  the  unplanned  delay  resulted  in  pulling  through  the  vertical  prior  to  the  start  of  the  recovery, 
it  is  still  less  than  half  of  the  TSM  expected  for  the  maneuver  without  unplanned  delay. 

Before  we  go  on,  some  definitions  are  in  order. 

•  “Instantaneous  TSM  (ITSM)” — The  TSM  for  a  complete  maneuver,  including  the  effects  of  any  un¬ 
planned  delay. 

•  “Delayed  TSM  (DTSM)” — The  TSM  for  a  maneuver  found  by  adding  the  unplanned  delay  to  the 
ITSM.  DTSM  may  be  thought  of  as  the  sum  of  the  two  predominant  sources  of  time  delay  in  a 
maneuver;  time  delay  at  the  worst  possible  point  in  the  maneuver  for  adding  delay  (the  worst-case 
vector),  and  unplanned  time  delay  at  the  end  of  the  procedure  (where  delay  is  most  likely  to  occur). 

DTSM  =  ITSM  +  Unplanned  Delay 

Let’s  return  to  figure  17  for  an  example  of  calculating  DTSM.  For  the  sake  of  simplicity,  assume  that  the 
true  airspeed  remains  constant  throughout  the  three  example  maneuvers;  this  will  allow  the  presentation  of 
unplanned  delay,  ITSM,  and  DTSM  using  the  flight  path  lengths.  Figure  18  depicts  these  times  graphically 
for  each  of  the  maneuvers  in  figure  17.  The  DTSM  provides  a  measure  of  the  total  time  available  for  delay, 
captured  by  adding  the  unplanned  recovery  delay  and  the  resulting  ITSM.  The  no-unplanned-delay  case 
shows  the  best  case  for  ITSM,  but  any  delay  in  initiating  the  recovery  rapidly  reduces  the  ITSM.  The  first 
delay  increment,  shown  in  red,  results  in  a  severe  reduction  in  ITSM  but  this  is  mitigated  somewhat  by  the 
time  of  the  unplanned  delay;  it  takes  time  to  get  to  this  low  ITSM  and  this  time  is  available  as  margin  prior  to 
the  start  of  the  recovery.  The  second  increment  of  unplanned  delay,  shown  in  blue,  results  in  slightly  more 
ITSM  than  the  first  increment.  When  the  unplanned  delay  time  is  added,  the  DTSM  is  greater  than  that 
for  the  original  maneuver.  This  indicates  that,  for  this  particular  procedure,  the  safest  way  to  avoid  ground 
impact  might  be  to  just  continue  the  pull  all  the  way  around  to  level  flight;  the  pilot  is  far  less  likely  to  delay 
the  recovery  when  the  recovery  is  nothing  more  than  continuing  the  original  procedure.  These  examples 
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only  represent  three  points  on  a  curve  where  the  independent  value  is  the  unplanned  recovery  time  and  the 
dependent  value  is  the  DTSM.  If  DTSM  is  used  to  calculate  an  overall  TSM,  the  TSM  is  the  minimum 
value  of  DTSM  across  this  curve.  (See  figure  22  for  an  example  of  a  complete  DTSM  curve  for  a  similar 
maneuver.) 


Figure  18  Calculation  of  DTSM  from  Figure  17 


When  DTSM  is  included  in  the  computation  of  TSM,  TSM  is  the  minimum  DTSM  for  the  full  recover¬ 
able  range  of  unplanned  delay.  The  unplanned  delay  starts  at  0  seconds  and  ends  either  when  the  unplanned 
delay  results  in  a  recovery  prior  to  initiation  of  the  planned  recovery  (think  of  a  split-s  procedure  that  con¬ 
tinues  at  the  initial  Nz  until  a  climb  is  achieved)  or  when  the  unplanned  delay  results  in  no  ground  collision 
margin.  Using  DTSM  to  calculate  overall  TSM,  a  TSM  of  4  seconds  could  mean  “Recovery  as  planned  has 
a  TSM  of  4  seconds”  or  “Delaying  the  recovery  by  more  than  4  seconds  will  result  in  ground  impact  during 
the  recovery.”  It  could  also  mean  “Delaying  the  recovery  by  1  second  results  in  an  ITSM  of  3  seconds.”  So 
long  as  the  sum  of  the  unplanned  delay  and  the  ITSM  for  that  unplanned  delay  is  the  minimum  value  across 
the  full  range  of  available  unplanned  delay,  the  TSM  is  the  margin  of  safety  with  respect  to  time.  Test  teams 
should  express  TSM  in  a  way  that  captures  the  amount  of  unplanned  delay  added  for  the  TSM  as  part  of 
the  final  TSM  presentation,  e.g.,  “The  TSM  for  the  maneuver  is  4  seconds  including  1  second  of  unplanned 
delay  at  initiation.” 

Delayed  Time  Safety  Margin  captures  the  additional  risk  of  unplanned  delay  as  part  of  the  final  TSM 
value,  making  it  reasonable  to  use  standard  TSM  guidance.  The  additional  effort  required  to  determine  a 
valid  DTSM  profile  is  only  justified  when  consideration  of  DTSM  would  change  the  final  TSM  result.  An 
examination  of  how  DTSM  changes  with  unplanned  delay  for  a  variety  of  diving  maneuvers  will  show  that 
DTSM  is  only  a  factor  if  the  dive  angle  is  increasing  at  the  expected  recovery  start;  if  the  dive  angle  is  steady 
or  decreasing  the  DTSM  should  not  decrease  with  unplanned  delay. 

DTSM  Examples: 

The  following  examples  show  the  TSM  implications  for  most  dive  recovery  situations.  These  examples 
assume  that  the  N-  and  bank  angle  of  the  aircraft  remain  unchanged  during  the  unplanned  delay.  If  a  test 
procedure  ends  with  a  non-zero  roll  rate  and/or  Nz  rate,  it  is  prudent  to  use  the  worst-case  overshoot  of 
these  parameters  as  part  of  the  worst-case  conditions  used  to  determine  TSM.  Failure  to  do  this  could  result 
in  a  much  higher  dive  angle  rate-of-change  during  any  unplanned  delay,  leading  to  a  much  lower  minimum 
DTSM  than  expected. 
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DTSM  in  an  Upright  Steady  Dive. 


The  simplest  form  of  TSM  stays  simple  for  DTSM.  In  a  steady  dive  with  a  constant  dive  angle  and 
airspeed,  the  worst-case  vector  corresponds  to  the  point  just  prior  to  the  addition  of  Nz  for  recovery.  The 
TSM  vector  is  the  vector  of  the  steady  dive,  so  unplanned  delay  just  keeps  the  aircraft  on  that  vector.  In  a 
steady  dive,  the  TSM  decreases  by  one  second  for  every  second  of  unplanned  delay  and  the  DTSM  remains 
constant  as  unplanned  delay  is  added. 

Figure  19  depicts  how  ITSM  and  DTSM  change  over  time  for  a  steady  dive.  As  unplanned  delay  time 
is  added,  the  ITSM  decreases  at  one  second  per  second  until  the  ITSM  is  nil.  Adding  the  unplanned  delay 
time  to  the  resulting  ITSM  produces  a  constant  DTSM,  so  DTSM  need  not  be  used  to  determine  TSM. 


TSM 


Unplanned  Recovery  Delay  Time 


- ITSM 

- DTSM 


Figure  19  ITSM  and  DTSM  Changes  for  a  Steady  Dive 


Things  become  a  little  more  complicated  if  power  effects  are  taken  into  account.  If  the  airspeed  is 
increasing  just  prior  to  starting  the  recovery,  any  unplanned  delay  in  the  recovery  will  result  in  increased 
airspeed  for  the  pull-out  which,  in  turn,  decreases  the  time  to  an  unrecoverable  condition  by  increasing  the 
turn  radius  and  getting  there  more  quickly.  DTSM,  however,  will  remain  unchanged  so  long  as  the  increasing 
airspeed  is  accounted  for  in  the  TSM-defining  vector  to  the  last  possible  recovery  initiation  point.31 

In  an  upright  steady  dive  the  safety  margin  remains  the  same  regardless  of  whether  the  pilot  inadvertently 
delays  recovery  or  delays  at  the  worst-case  vector.  This  is  obvious,  of  course,  since  the  worst-case  vector 
and  the  TSM  vector  arc  the  same.  DTSM  is  never  less  than  the  ITSM  for  no  unplanned  delay,  so  the  TSM 
need  not  consider  unplanned  delays. 

DTSM  in  an  Upright  Wings-Level  Pull. 

If  the  beginning  of  the  dive  recovery  is  marked  by  a  wings-level  pull  that  produces  a  steadily-decreasing 
dive  angle,  the  effect  on  ITSM,  DTSM,  and  the  overall  TSM  is  dependent  on  how  the  Nz  will  be  changed 
for  the  recovery. 

Figure  20  shows  the  three  basic  possibilities  for  this  recovery.  In  the  first  case,  the  recovery  Nz  is  less 
than  the  procedure  Nz.  In  the  second,  the  recovery  and  procedure  Nz  arc  the  same.  The  third  case  shows 
what  happens  when  the  recovery  Nz  is  greater  than  the  procedure  Nz. 

31  Accounting  for  thrust  effects  requires  excellent  modeling  and  simulation. 
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Figure  20  ITSM  and  DTSM  Changes  for  a  Wings-Level  Dive  Pullout  Starting  with  a  Decreasing 

Dive  Angle 


The  first  case  is  the  more  conventional  case;  the  diving  procedure  is  at  substantially  less  Nz  than  the 
planned  recovery  Nz,  so  at  the  completion  of  the  test  point  the  Nz  will  be  increased  for  the  recovery.  In 
this  case,  delaying  the  recovery  increases  the  altitude  lost  and  decreases  the  ITSM.  Nevertheless,  if  the  Nz 
during  the  wings-level  procedure  is  sufficient  to  decrease  the  dive  angle,  the  ITSM  will  not  be  decreasing 
faster  than  one  second  per  second  so  the  DTSM  will  be  constantly  increasing.  Thus,  the  overall  TSM  is  the 
ITSM  with  no  unplanned  delay;  DTSM  need  not  be  considered. 

We  saw  that  the  DTSM  remained  the  same  for  a  steady  dive,  but  when  the  wings-level  pull  during  the 
procedure  is  not  changed  for  the  recovery  the  ITSM  remains  the  same  and  the  DTSM  steadily  increases. 
This  makes  sense  because  the  maneuver  does  not  change  with  the  delay.  The  overall  TSM  is  the  ITSM  with 
no  unplanned  delay;  DTSM  need  not  be  considered. 

If  the  recovery  Nz  is  less  than  the  procedure  Nz  (as  might  be  the  case  if  the  procedure  N-  is  high  enough 
to  warrant  minimizing  exposure  to  g-induced  loss  of  consciousness  (GLOC),  any  unplanned  delay  will 
improve  the  ITSM.  In  this  case,  the  ITSM  line  starts  with  a  positive  slope  and  curves  upward  until  the 
unplanned  delay  time  results  in  a  recovery  prior  to  the  start  of  the  actual  recovery.  Even  though  the  ITSM 
and  DTSM  arc  constantly  increasing  during  a  maneuver  like  this,  the  overall  TSM  would  remain  the  ITSM 
for  no  unplanned  delay  because  that  would  be  the  minimum  DTSM  for  the  recovery. 

What  does  it  take  for  the  DTSM  to  decrease  in  a  wings-level  dive — for  things  to  get  worse  with  un¬ 
planned  delay?  We  have  seen  that  DTSM  remains  constant  in  a  steady  dive  with  a  constant  dive  angle  and 
that  DTSM  will  always  be  increasing  when  the  dive  angle  is  decreasing.  All  that  is  left  to  consider  is  when 
the  dive  angle  is  increasing  at  the  planned  staid  of  the  recovery. 

DTSM  in  an  Upright  Wings-Level  Push. 


It  is  not  uncommon  to  target  an  Nz  less  than  1  g  during  flight  test.  Sometimes  the  most  convenient  way 
to  get  there  is  from  a  wings-level  push.  These  test  procedures  typically  result  in  a  dive.  What  does  this  mean 
for  TSM? 

Figure  2 1  depicts  how  ITSM  and  DTSM  change  for  a  wings-level  push  starting  in  a  slight  dive  and  at 
an  altitude  that  is  low  enough  that  inadvertently  delaying  the  push  will  eventually  result  in  an  unrecoverable 
dive.  In  this  situation,  the  TSM-defining  worst-case  vector  occurs  in  a  steeper  dive  and  at  a  lower  altitude 
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the  longer  the  recovery  is  delayed;  this  results  in  steadily-decreasing  ITSM  and  DTSM.32  In  this  case,  the 
TSM  for  the  dive  would  be  the  DTSM  corresponding  to  the  unplanned  delay  time  that  results  in  an  ITSM  of 
0  seconds. 


Figure  21  ITSM  and  DTSM  for  a  0-g  Unload  from  a 
Shallow  Dive 


Wings-level  push-over  procedures  can  be  deceptively  risky  thanks  to  the  very  rapid  decrease  in  ITSM 
with  recovery  delayed.  Imagine  a  procedure  flown  at  relatively  low  altitude — perhaps  to  achieve  a  high 
dynamic  pressure  (q) — designed  to  be  at  - 1  g  in  level  flight  by  stalling  the  procedure  from  a  slight  climb. 
If  a  dive  is  never  attained  during  the  test  point  no  dive  recovery  is  required,  ITSM  is  not  defined,  and  all 
appears  well.  But  if  the  pilot  is  slow  to  achieve  the  Nz,  stays  there  too  long,  or  exceeds  the  planned  Nz,  the 
ITSM  will  be  decreasing  rapidly  as  soon  as  the  aircraft  enters  a  dive.33 

DTSM  in  an  Abbreviated  Split-S. 


A  full  “split-s”  aerobatic  maneuver  starts  in  inverted  level  flight  and  ends  in  upright  level  flight.  The 
pilot  rolls  inverted  and  pulls  through  the  vertical  until  the  aircraft  is  back  in  level  flight.  This  procedure  is 
relatively  trivial  with  regal'd  to  TSM  since  the  maneuver  includes  the  recovery;  there  is  no  place  to  add  delay 
other  than  at  the  worst-case  vector  so  DTSM  doesn’t  apply.  But  this  simplicity  comes  at  the  cost  of  altitude 
and  energy  loss — something  most  test  teams  are  hesitant  to  accept  unnecessarily. 

In  flight  test,  a  split-s  maneuver  is  typically  an  abbreviated  form  of  the  aerobatic  maneuver.  By  trading 
potential  energy  (altitude)  to  maintain  kinetic  energy  (airspeed),  it  is  possible  to  stabilize  for  a  few  seconds 
on  an  airspeed  or  Mach  number  that  could  only  otherwise  be  transited  very  quickly.  In  order  to  minimize 
energy  loss,  a  flight  test  split-s  procedure  is  typically  stopped  far  short  of  the  vertical  and  a  routine  dive 
recovery  maneuver  is  accomplished  to  minimize  altitude  loss,  energy  loss,  and  risk. 

32  The  curve  shallows  as  the  dive  angle  increases  because  the  effect  of  gravity  is  decreasing  and  the  vertical  velocity  is  changing 
less  for  each  degree  of  added  dive  angle.  If  the  push  is  between  0  g  and  1  g,  the  dive  angle  will  stop  increasing  as  the  dive  angle 
coincident  with  that  N.  (Nz  =  g  cos  y)  is  approached.  Once  this  happens,  the  DTSM  remains  constant  and  the  ITSM  changes  at 
one  second  per  second  because  the  aircraft  has  achieved  a  steady-state  wings-level  dive. 

33  As  an  instructor  pilot  at  the  US  AF  Test  Pilot  School,  the  author  has  seen  many  students  attempt  to  set  a  —Nz  point  from  wings-level 
flight  or  a  slight  climb;  the  rate  at  which  the  dive  angle  builds  often  seems  to  come  as  a  surprise. 
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Figure  22  depicts  the  progression  of  ITSM  and  DTSM  for  a  split-s  procedure  as  unplanned  delay  is 
added  past  the  planned  recovery  dive  angle.  This  particular'  procedure  is  designed  to  be  flyable  all  the  way 
through  the  vertical  and  back  to  level  flight  like  an  aerobatic  split-s;  this  is  indicated  by  the  ITSM  remaining 
greater  than  zero.  (If  the  split-s  procedure  would  result  in  an  unrecoverable  condition  if  continued  past 
the  planned  recovery  conditions,  the  ITSM  would  terminate  at  zero  and  the  figure  would  look  much  like 
figure  21.) 


Unplanned  Recovery  Delay  Time 


Figure  22  ITSM  and  DTSM  Changes  for  a  Short-Term 
Split-S  Procedure 


This  figure  has  some  discontinuities  that  divide  it  into  distinct  time  periods.  These  are  the  result  of 
assumptions  about  how  the  pilot  will  accomplish  the  recovery  based  on  the  conditions  at  which  the  recovery 
is  started.  The  first  unplanned  delay  time  period  depicts  when  the  recovery  requires  a  180-degree  roll  to  the 
“nearest  horizon”  after  unloading  to  the  rolling  Nz.  In  the  third  time  period,  the  unplanned  delay  has  caused 
the  aircraft  to  pass  the  nadir  before  the  recovery  is  started  so  the  pilot  just  adjusts  the  N-  to  the  recovery 
Nz  and  continues  the  pull  until  the  recovery  is  complete;  not  having  to  unload  to  rolling  /V,  and  roll  upright 
saves  a  lot  of  time  and  altitude.  The  middle  time  period  corresponds  to  where  the  aircraft  passes  the  nadir 
while  the  pilot  is  unloading  to  the  rolling  Nz  then,  with  no  roll  required,  just  increases  the  pull  to  recovery 
N-m  For  this  example,  the  minimum  DTSM  occurs  at  the  end  of  the  first  time  period;  if  DTSM  were  used 
to  determine  TSM  for  the  maneuver,  the  TSM  would  be  the  minimum  DTSM  as  this  is  the  worst  case  for 
added  delay. 

This  example  shows  how  sensitive  TSM  computations  are  to  the  planned  and  actual  maneuver  execution. 
It  might  be  reasonable  to  trade  a  little  TSM  to  keep  the  maneuver  simple  and  lower  the  potential  for  planning 
mistakes  or  execution  errors. 

When  the  Worst-Case  Vector  Occurs  Before  the  Unplanned  Delay  is  Complete: 


Delayed  Time  Safety  Margin  may  be  calculated  for  the  entire  range  of  unplanned  delay  that  does  not 
result  in  a  recovery  prior  to  the  end  of  the  unplanned  delay.  In  those  recoveries  that  begin  with  the  dive  angle 
moving  toward  the  horizon,  the  worst-case  vector  will  not  change  with  the  addition  of  delay.  Calculating 

34  The  recovery  model  used  for  this  simulation  assumes  that  once  the  pilot  starts  to  unload  to  rolling  Nz  he  will  not  notice  whether 
or  not  the  aircraft  has  passed  the  nadir  until  the  unload  is  complete. 
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DTSM  for  these  cases  is  not  necessary  because  unplanned  delay  will  not  decrease  the  ITSM  by  more  than 
one  second  per  second  of  delay.  Figure  20  depicts  three  dives  where  the  climb  angle  is  moving  toward 
the  horizon  at  the  planned  start  of  the  recovery;  the  difference  is  the  relationship  to  the  recovery  Nz  and 
procedure  Nz.  In  these  cases,  the  ITSM  is  increasing  more  rapidly  than  the  DTSM  unplanned  delay  is 
added.  This  may  be  seen  as  yet  another  good  reason  to  tty  to  complete  test  procedures  with  the  dive  angle 
stable  or  moving  toward  the  horizon. 

In  a  maneuver  that  starts  with  the  dive  angle  moving  away  from  the  horizon,  at  some  point  during  the 
unplanned  delay  (assuming  that  the  maneuver  is  not  interrupted  by  the  ground)  the  dive  angle  will  probably 
pass  through  a  point  of  maximum  steepness.35  This  is  typical  of  split-s  maneuvers.  If  the  unplanned  delay  is 
long  enough  for  the  aircraft  to  pass  through  the  nadir,  additional  delay  past  that  point  will  aid  the  recovery. 
Figure  22  depicts  the  change  of  ITSM  and  DTSM  for  the  entire  range  of  unplanned  recovery  delay  time, 
terminating  where  the  unplanned  delay  results  in  a  completed  recovery.  For  this  example,  the  worst-case 
vector  stops  changing  just  prior  to  the  end  of  the  second  segment. 

Does  the  Ratio  of  Unplanned  Delay  and  ITSM  Matter  for  the  Overall  TSM?: 

When  unplanned  delay  prior  to  the  recovery  is  taken  into  account  to  determine  TSM,  the  use  of  TSM 
for  risk  reduction  must  be  considered  as  a  two-dimensional  problem.  For  instance,  does  an  overall  TSM 
of  5  seconds  with  no  unplanned  delay  carry  the  same  risk  as  a  minimum  DTSM  of  5  seconds  including 
5  seconds  of  unplanned  delay  leading  to  an  ITSM  of  0  seconds?  How  about  a  minimum  DTSM  of  5  seconds 
including  2.5  seconds  of  unplanned  delay  with  an  ITSM  of  2.5  seconds?  Using  the  DTSM  method,  each 
of  these  have  the  same  overall  TSM  of  5  seconds,  but  are  they  equally  risky?  The  answer  to  this  question 
seems  to  rest  upon  the  likelihood  of  each  type  of  error.  Is  the  pilot  more  likely  to  delay  past  the  planned 
delay  time  or  is  he  more  likely  to  delay  at  the  worst-case  vector? 

Thanks  to  the  nature  of  these  maneuvers,  the  pilot  is  more  likely  to  delay  at  the  expected  recovery  start 
point  because  this  is  the  automatic  result  if  the  recovery  is  inadvertently  delayed.  Except  for  the  simplest 
recoveries,  the  worst-case  vector  is  passed  dynamically  and  the  pilot  has  little  awareness  that  it  has  happened; 
he  is  much  less  likely  to  delay  there. 

The  simplest  solution  is  to  use  the  TSM  in  the  risk  reduction  and  assessment  criteria  without  regal'd  to 
how  much  of  it  came  from  the  unplanned  delay.  Five  seconds  of  error  is  five  seconds  of  error,  no  matter 
the  source.  The  requirements  associated  with  any  particular  TSM  should  prevent  a  significant  exceedance, 
especially  since  these  requirements  are  designed  in  part  to  ensure  that  the  pilot  does  not  delay  significantly 
beyond  the  intended  recovery  condition. 

There  might  be  other  solutions  as  well;  for  a  split-s  maneuver  consider  simplifying  the  maneuver  by 
maintaining  the  initial  Nz  all  the  way  to  recovery  instead  of  stopping  the  maneuver  in  a  dive  and  using  a 
standard  nose-low  recovery.  This  may  result  in  more  altitude  loss,  but  the  altitude  loss  will  be  much  more 
predictable  as  the  maneuver  is  much  less  subject  to  error.  Sometimes  the  simplest  solution  will  give  the 
safest  result  in  spite  of  decreasing  the  TSM.  (Keep  in  mind  that  the  altitude  loss  might  be  increased,  making 
the  maneuver  less  efficient;  these  are  risk  management  decisions  the  test  team  must  consider.)  It  is  also  very 
possible  that  the  planned  procedure  isn’t  as  necessary  as  tradition  would  imply;  perhaps  it  is  possible  to  get 
the  time  at  an  elevated  Nz  using  a  wings-level  pull  from  a  dive  instead  of  using  a  split-s  maneuver.  If  it  is, 
the  overall  TSM  may  be  much  more  favorable. 

The  most  important  lesson  that  DTSM  teaches  us  is  that  any  maneuver  that  finishes  with  the  dive  angle 
35  There  are  clearly  cases  where  this  is  not  true,  such  as  a  wings-level  0-g  push. 
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increasing  carries  additional  CFIT  risk.  If  the  test  point  can  be  achieved  using  a  procedure  that  is  completed 
with  the  dive  angle  steady  or  decreasing,  that  procedure  should  be  favored.  If  the  procedure  must  be  com¬ 
pleted  with  the  dive  angle  increasing,  a  sensible  amount  of  delay  should  be  added  to  the  end  of  the  procedure 
and  the  effect  of  additional  delay  past  that  point  must  be  considered  in  the  TSM  calculation.  Delayed  TSM 
is  an  option  for  taking  that  unplanned  delay  into  account  in  determining  TSM. 

THE  BASICS  OF  TSM  EMPLOYMENT 

Time  Safety  Margin  captures  the  residual  CFIT  risk  of  a  diving  maneuver  in  a  single  numerical  value 
that  approximates  the  minimum  amount  of  time  available  to  recognize  errors.  Time  Safety  Margin  is  always 
an  estimate,  but  the  quality  of  that  estimate  is  a  function  of  the  quality  of  the  maneuver  planning;  reducing 
the  uncertainty  of  a  low  TSM  can  involve  dozens  of  factors  and  many  hours  of  effort,  practice,  and  buildup. 
Time  Safety  Margin  should  be  paid  of  the  entire  dive  planning  process,  not  just  a  value  calculated  after  the 
planning  is  complete.  When  TSM  approaches  human  reaction  time,  minimization  of  uncertainty  becomes  a 
life-or-death  task. 

Test  Point  Planning  for  TSM: 


If  TSM  is  the  CFIT-prevention  criteria  by  which  your  planning  will  be  judged,  it  should  influence  your 
planning  from  the  very  staid.  If  the  objective  might  require  a  TSM  of  less  than  8  seconds,  you  will  probably 
need  to  iterate  your  TSM  planning  until  your  plan  meets  the  requirements  for  the  TSM.  Documentation  must 
be  thorough  enough  to  ensure  correct  execution. 

Draft  a  Procedure  that  Meets  the  Objective. 

Test  procedures  arc  designed  to  gather  a  specific  set  of  data  either  through  a  range  of  conditions  (such  as 
a  check  descent  for  performance  manual  verification)  or  at  a  specific  condition  (such  as  a  weapons  separation 
point).  Aircraft  performance  and  handling  qualities  will  heavily  influence  the  procedure  required  to  meet 
the  conditions,  so  the  procedure  is  often  defined  entirely  by  the  objective.  If  you  have  a  physics-based  tool 
to  estimate  TSM,  you  should  use  it  to  get  a  rough  estimate  of  the  TSM  or,  if  you  have  some  flexibility  in  the 
procedure,  “rough  out”  the  maneuver,  seeking  to  maximize  the  TSM  while  achieving  the  objective.  As  with 
all  flight  test  points,  the  objective  must  justify  the  risk.  Time  Safety  Margin  can  help  quantify  the  risk  and 
aid  the  test  team  and  approval  authorities  in  determining  if  the  objective  is  worth  the  risk. 

Set  Terminate  and  Abort  Criteria. 


Terminate  and/or  abort  criteria  arc  a  vital  part  of  TSM  planning.  They  provide  the  points  in  time  or 
space  that  either  call  for  an  immediate  recovery  when  the  test  point  is  not  going  to  be  successful  or  when 
the  recovery  must  be  started  to  preserve  the  desired  safety  margins.  For  unanticipated  situations  that  arc 
developing  into  a  dangerous  situation,  such  as  failure  to  respond  to  an  “Abort!”  call,  “Knock-it-off!”  is 
commonly  used.  Edwards  AFB  instruction  99-103  (2014),  Test  Control  and  Conduct  (reference  6)  defines 
these  criteria  as  follows: 

•  “Terminate”-ceases  flight  test  execution  when  continued  maneuvering  or  progress  will  not  achieve 
desired  results. 

•  “Aborfi’-alerts  flight  test  crews  that  planned  maneuver  limits  will  be  exceeded,  and  directs  aircrew  to 
initiate  the  planned  recovery  procedure  immediately. 

•  “Knock-it-off”-alerts  flight  test  crews  that  a  dangerous  situation  is  developing  and  directs  all  par¬ 
ticipating  aircrew  to  cease  maneuvering,  establish  safe  flight  parameters,  deconflict  flight  paths,  and 


39 


obtain  situational  awareness  on  all  flight  members. 


A  properly  planned  test  point  will  have  defined  tolerances  for  critical  parameters.  These  tolerances 
should  be  only  tight  enough  to  ensure  valid  data  in  every  corner;  too-tight  tolerances  reduce  test  efficiency. 
In  general,  exceeding  a  tolerance  will  call  for  termination  of  a  test  point,  but  there  are  instances  where  a 
momentary  exceedance  might  be  tolerable.  Termination  criteria  are  about  effectiveness  and  efficiency — not 
safety — and  are  applied  with  test  team  judgment. 

Abort  parameters  arc  typically  determined  prior  to  flight — or  at  the  very  latest,  prior  to  the  execution 
of  the  procedure — and  arc  non-negotiable  during  execution.  They  should  be  part  of  TSM  planning  if  the 
test  maneuver  will  have  less  than  8  seconds  of  TSM.  If  an  abort  parameter  is  exceeded,  “Abort!”  is  called 
and  the  aircraft  is  immediately  recovered.  Abort  parameters  arc  usually  achieved  after  terminate  parameters 
but  it  is  entirely  possible  for  abort  parameters  to  be  more  restrictive  than  terminate  parameters,  especially 
when  successful  data  collection  could  result  in  an  unnecessarily  hazardous  dive.  If  an  abort  parameter  is 
inadvertently  passed  or  the  pilot  fails  to  respond  to  an  “Abort!”  call,  a  “Knock-it-off!”  call  is  warranted. 

With  sufficiently  high  TSM,  it  is  reasonable  to  use  terminate  criteria  as  the  trigger  to  begin  the  recovery. 
If  TSM  is  8  seconds  or  more,  the  pilot  may  be  held  responsible  for  preventing  CFIT  based  solely  on  his 
routine  dive  recovery  training.  In  this  case,  having  a  separate  abort  criteria  probably  isn’t  necessary;  the 
pilot  would  be  expected  to  recover  upon  termination  of  the  test  point.  If  he  doesn’t,  an  “Abort!”  or  “Knock- 
it-off!”  call  would  be  warranted. 

Time  Safety  Margin  must  be  calculated  using  the  worst-case  combination  of  abort  criteria  (or  termination 
criteria  if  abort  criteria  arc  not  used).  It  is  unlikely  that  all  of  these  criteria  will  be  met  at  the  same  instant, 
so  this  approach  provides  additional  margin  by  ensuring  that  the  test  team  can  hit  all  of  their  abort  and/or 
terminate  criteria  at  the  same  time  and  still  have  no  less  than  the  planned  TSM.  In  general,  the  worst- 
case  abort  will  include  the  maximum  allowable  dive  angle,  bank  angle,  airspeed  or  Mach,  and  the  minimum 
allowable  altitude.  Other  abort  criteria  may  be  added  as  necessary,  including  relevant  aircraft  system  failures, 
maximum  throttle  settings  if  the  pilot  is  modulating  the  power  in  a  limited  range,  loss  of  telemetry,  improper 
chase  aircraft  positioning,  and  so  on. 

Abort  conditions  arc  cannot  help  prevent  CFIT  if  the  test  team  misses  an  exceedance  during  execution. 
As  the  TSM  decreases  below  8  seconds,  it  will  be  necessary  to  employ  reliable  and  increasingly  extensive 
techniques  to  ensure  that  an  “Abort!”  call  is  neither  late  nor  misunderstood.  Techniques  for  this  might 
include  technological  solutions  such  as  special  control  room  displays  and  aircraft  alerting  systems,  as  well  as 
more  traditional  methods  such  as  chase  aircraft  and  ground  observers.  Limits  Based  Monitoring  of  Dynamic 
Flight  Test  Maneuvers  (reference  7)  is  a  particularly  useful  description  of  a  way  to  use  control  room  displays 
to  reduce  the  likelihood  of  exceeding  limits. 

Plan  the  Dive  Recovery. 


If  the  TSM  is  going  to  be  less  than  8  seconds,  the  pilot  should  have  a  pre-planned  recovery  procedure. 
This  procedure  should  be  the  same  regardless  of  the  conditions  that  initiate  it;  this  will  prevent  increasing 
the  risk  of  CFIT  by  accidentally  executing  the  wrong  recovery.  Ideally,  pilot  error  will  result  in  less  altitude 
loss,  not  more. 

Inevitable  errors  during  the  recovery  require  the  use  of  safety  margins  for  recovery  parameters.  For 
instance,  planning  to  use  the  maximum  allowable  N-  during  the  recovery  almost  ensures  that  the  pilot  will 
recover  at  less  N-  than  planned  and  lose  more  altitude  than  expected.  The  same  goes  for  planning  for  the 
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maximum  roll  rate,  maximum  g-onset  rate,  and  the  maximum  asymmetric  Nz  (which  is  particularly  unlikely 
to  be  achieved). 

The  closer  the  recovery  parameters  arc  to  the  aircraft  limits  and  the  further  they  arc  from  the  pilot’s 
previous  training,  the  more  important  practice  and  buildup  become.  For  the  sake  of  minimizing  training  and 
avoiding  negative  transference,  the  planned  recovery  should  be  very  similar  to  the  dive  recovery  the  pilot 
has  trained  to  use  in  the  aircraft. 

Margins  need  not  be  added  for  parameters  that  arc  not  subject  to  error  or  change.  For  instance,  in  an  over¬ 
water  test  the  surface  elevation  is  known  so  no  altitude  margin  should  be  necessary;  the  margin  encapsulated 
in  the  TSM  is  enough.  If  the  same  test  is  conducted  over  land,  the  surface  elevation  will  change  with  the 
location  of  the  dive  so  the  test  team  must  either  be  very  careful  about  where  the  maneuver  is  conducted  or, 
to  retain  flexibility  in  scheduling,  just  use  the  highest  elevation  in  a  specified  area. 

Do  not  use  altitude  margins  required  by  regulations  to  define  the  surface  elevation  for  TSM.  For  instance, 
consider  a  test  team  saddled  with  a  requirement  to  complete  all  testing  above  2,000  ft  AGL:  They  should 
plan  their  maneuver  to  remain  above  2,000  ft  AGL,  but  calculate  their  TSM  using  the  surface  elevation. 

As  the  TSM  decreases  below  about  4  seconds,  it  might  be  necessary  to  plan  for  such  things  as  the  worst 
expected  atmospheric  conditions  and  altimeter  lag. 

Plan  for  Expected  Recovery  Delay. 

There  will  be  a  measurable  time  between  the  decision  to  end  the  maneuver  and  the  start  of  the  dive 
recovery.  In  some  cases,  such  as  an  unexpected  “ABORT”  call  from  a  control  room  during  a  maneuver 
requiring  intense  pilot  concentration,  this  may  be  three  or  more  seconds.  In  other  cases,  such  as  a  steady 
dive  with  a  set  recovery  altitude  that  the  pilot  is  closely  monitoring,  this  delay  may  be  in  tens  of  milliseconds. 
Either  way,  an  expected  reaction  time  must  be  part  of  the  maneuver  plan  if  the  addition  of  the  delay  will 
result  in  a  TSM  of  less  that  8  seconds.  For  instance,  if  you  think  your  TSM  will  be  9  seconds  but  you  expect 
a  three  second  delay  between  the  end  of  the  maneuver  and  start  of  the  recovery,  your  actual  TSM  will  be 
closer  to  6  seconds  and  perhaps  even  less.  It  is  especially  important  to  plan  for  expected  recovery  delay  if 
the  dive  angle  will  be  increasing  at  the  worst-case  abort  condition. 

Decide  How  to  Handle  Unplanned  Recovery  Delay. 

Delayed  Time  Safety  Margin  may  be  employed  if  your  worst-case  abort  conditions  have  the  dive  angle 
increasing;  it  is  unnecessary  otherwise.  If  you  choose  not  to  use  DTSM  to  calculate  TSM,  it  will  be  very 
important  to  ensure  that  the  pilot  does  not  delay  past  the  planned  delay  time.  It  might  be  reasonable  to 
increase  the  planned  delay  to  add  additional  conservatism,  but  the  importance  of  immediate  recovery  must 
be  emphasized  to  the  test  team. 

Use  TSM  to  Inform  Planning  Iterations. 


Once  the  maneuver  has  been  designed,  TSM  should  be  calculated  in  accordance  with  test  organization 
requirements,  normally  by  using  the  worst-case  parameters.  In  general,  as  TSM  decreases  below  8  seconds, 
the  requirements  for  computation  and  model  accuracy,  buildup  procedures,  abort  decision  back-up,  pre¬ 
flight  practice,  and  pilot  cueing  will  increase.  With  increased  accuracy  in  the  modeling  of  the  aircraft 
performance  and  flying  qualities,  the  calculated  value  of  TSM  will  change.  This  will  either  simplify  the 
process  by  showing  that  the  TSM  is  better  than  initially  calculated,  or  it  will  make  things  more  complex  by 
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adding  requirements  when  the  TSM  is  worse  than  initially  calculated.  It  is  at  this  point  that  the  test  team 
must  decide  how  to  act.  Can  the  requirements  be  met  with  a  different  maneuver?  Can  the  abort  criteria 
be  tightened  up?  Can  training  be  employed  to  reduce  the  planned  delay  time?  Can  the  location  of  the  test 
point  be  moved  to  a  place  where  the  terrain  is  nearer  to  sea  level?  Can  the  dive  recovery  maneuver  be  more 
aggressive? 

Consider  Training,  Buildup,  and  Currency. 


The  original  AFFTC  TSM  requirements  called  for  a  buildup  process  prior  to  attempting  any  maneuver 
with  less  than  8  seconds  of  TSM  (see  table  9).  If  the  TSM  was  less  than  4  seconds,  simulator  rehearsal  was 
also  required.  These  arc  very  reasonable  methods  to  ensure  that  the  pilot  and  test  team  arc  properly  prepared 
and  trained  for  low-TSM  maneuvers. 

Using  TSM  for  buildup  typically  starts  with  flying  the  maneuver  as  planned  but  with  at  least  8  seconds 
of  TSM.  The  ideal  buildup  maneuver  would  include  all  support  assets,  such  as  a  control  room  and  chase 
aircraft,  so  the  entire  team  can  practice  their  part  in  ensuring  a  safe  maneuver,  buildup  maneuvers  arc  also 
the  best  way  for  a  test  team  to  “check  their  math”  by  ensuring  that  their  maneuver  predictions  arc  correct  in 
the  real  world.  Buildup  should  start  with  8  seconds  of  TSM  and  additional  buildup  runs  should  be  added  in 
proportion  to  the  complexity  of  the  final  test  point  and  the  calculated  minimum  TSM. 

Simulator  practice  is  a  valuable  low-cost — and  no-risk — buildup  step  prior  to  the  in-flight  buildup  pro¬ 
cess.  The  test  team  can  evaluate  their  maneuver  and — within  the  limits  of  the  simulator — judge  whether  or 
not  their  plan  will  work.  Simulator  runs  to  evaluate  TSM  during  the  planning  process  should  not  be  used  to 
meet  a  build-up  requirement  unless  they  occur  within  a  few  weeks  of  the  actual  flight  test;  it  is  important  that 
the  actual  test  team  conduct  the  simulator  runs  and  that  they  be  near  enough  to  the  test  window  to  provide 
currency. 

Training  and  buildup  can  produce  a  very  well-prepared  test  team,  but  that  preparation  will  fade  with 
time.  As  the  TSM  decreases  below  8  seconds,  it  will  be  increasingly  important  to  complete  training  and 
buildup  just  prior  to  the  low-TSM  flight  test  points.  Set  a  limit  on  how  long  the  test  team  should  go  between 
completion  of  the  training  and  execution  of  the  test  point. 

Document  the  Dive  Planning. 


The  value  of  a  plan  is  realized  in  its  execution.  The  test  team  must  understand  the  assumptions  that  went 
into  the  maneuver  planning  and  must  adhere  to  the  plan  to  preserve  the  desired  TSM.  From  the  required 
pre-flight  training  to  the  completion  of  the  recovery  maneuver,  a  misconception  on  the  paid  of  the  test  team 
can  severely  reduce  the  TSM  and  increase  the  risk  of  CFIT.  Planners  should  not  assume  that  future  members 
of  the  test  team  will  be  aware  of  the  work  put  into  planning  the  test  point.  They  must  document  the  plan  to 
guard  against  their  own  imperfect  recollection  and  to  provide  for  the  education  of  new  team  members. 

Test  Point  Execution  with  TSM: 


The  first  step  in  executing  a  safe  and  effective  diving  maneuver — especially  one  with  a  TSM  of  less  than 
8  seconds — is  understanding  the  objective  of  the  maneuver  and  the  procedure,  recovery,  and  planned  delays 
that  went  into  the  TSM  computation.  Adherence  to  the  plan  is  vital  but  flight  test  often  presents  unexpected 
challenges  so  the  test  team  must  know  when  the  plan  has  gone  awry  and  react  accordingly. 
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Prepare  for  Success. 


Weeks,  even  months,  can  pass  between  the  completion  of  test  planning  and  the  execution  of  the  plan. 
Even  if  the  first  test  points  are  flown  the  day  after  final  test  plan  approval,  the  last  test  points — often  the  most 
hazardous — may  be  so  delayed  that  the  planning  process  will  become  a  distant  memory. 

Dive  maneuver  planning  often  entails  a  concentrated  effort.  The  reasons  for  important  decisions  and  the 
assumptions  behind  them  may  be  forgotten  or  may  have  gone  with  the  author  upon  acceptance  of  a  new 
job.  Ideally  the  test  and  safety  plan  will  be  complete  enough  that  this  will  not  matter  but  it  is  more  likely 
that  important  information  will  be  left  out  because  it  seemed  very  obvious  to  the  planning  team  as  they 
concentrated  on  their  work. 

The  test  execution  team  should  take  a  new — and  critical — look  at  the  test  and  safety  plan  as  the  test 
event  approaches.  Did  the  planners  miss  anything?  What  doesn’t  make  sense?  Is  it  too  conservative  or 
not  conservative  enough?  The  level  of  this  effort  should  inversely  correlate  with  the  TSM;  as  the  TSM 
decreases  below  about  4  seconds  the  test  team  will  need  to  be  at  the  top  of  their  game  by  having  an  excellent 
understanding  of  the  procedure,  the  recovery,  and  the  plan  by  which  the  team  will  safely  execute  the  entire 
maneuver. 

Complete  Required  Training  and  Buildup. 


When  required,  training  and  buildup  must  be  carefully  conducted  in  accordance  with  the  plan.36  Your 
TSM  is  only  as  good  as  your  models  and  your  ability  to  conduct  the  maneuver;  the  lower  the  TSM  is, 
the  more  important  these  factors  become  and  you  must  safely  evaluate  and  practice  the  maneuver  prior  to 
attempting  it  in  conditions  where  you  only  have  a  few  seconds  of  margin. 

Fly  in  Accordance  with  the  Plan. 


For  an  experienced  test  professional,  this  is  obvious,  but  the  temptation  to  improvise  can  be  powerful  in 
the  midst  of  the  “late-cycle  churn”  that  flight  test  teams  so  often  find  themselves  in.  A  mishap,  fatal  or  not, 
will  create  much  more  delay,  cost,  and  effort  than  preventing  the  mishap  and  may  even  cause  the  cancellation 
of  an  important  acquisition  program. 

ADDITIONAL  CONSIDERATIONS  FOR  TSM  EMPLOYMENT 

The  requirements  designed  for  the  initial  deployment  of  TSM  provide  a  good  starting  point  for  any 
organization  choosing  to  use  the  method,  but  it  is  easy  to  lose  some  of  the  fundamentals  in  the  details  of  a 
specific  set  of  rules.  It  is  not  just  a  risk  assessment  tool;  it  should  be  used  to  scope  the  level  of  effort  a  test 
team  puts  into  planning  diving  test  points. 

Test  planners  and  teams  must  keep  in  mind  that  TSM  is  only  designed  to  prevent  CFIT;  very  com¬ 
fortable  TSMs  arc  completely  insufficient  should  aircraft  control  be  lost  through  unexpected  events  such 
as  mid-air  collision,  structural  failure,  departure  from  controlled  flight,  disorientation,  or  g-induced  loss  of 
consciousness. 

TSM  and  Safety  Risk  Assessment: 

The  assumptions  and  approximations  that  go  into  calculating  TSM  assure  that  the  value  of  TSM  cannot 
be  thought  of  as  an  absolute  measure  of  CFIT  risk.  To  build  margin  against  unknowns,  TSM  is  calculated 

36  There  are  instances  of  simulator  practice  runs  unexpectedly  ending  in  a  ground  collision. 
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using  the  worst-case  recovery  initiation  conditions.  This  “worst-case  TSM”  is  probably  significantly  less 
than  the  TSM  for  the  nominal  recovery  condition.37 

Time  Safety  Margin  would  be  more  valuable  as  a  risk  assessment  tool  if  it  was  practical  to  include  a 
measure  of  uncertainty.  It  is  natural  to  assume  that  4  seconds  of  TSM  is  less  safe  than  8  seconds  of  TSM, 
but  this  assumption  is  based  on  a  deeper  assumption  that  the  precision  of  the  these  values  is  comparable. 
A  poorly  planned  8  second  TSM  maneuver  might  entail  much  more  CFIT  risk  than  a  tightly  planned  and 
practiced  4  second  TSM  maneuver. 

To  examine  the  expectations  of  TSM  accuracy  in  relation  to  risk  assessment,  we  will  look  at  the  USAF 
Test  Center  instructions  regarding  test  safety  review,  AFTC  Instruction  91-202  (2016),  AFTC  Test  Safety 
Review  Policy  (reference  8).  According  to  this  document,  if  the  probability  of  ground  impact  (a  catastrophic 
mishap)  is  I  0-3  or  greater,  an  assessment  of  “high  risk”  is  warranted.  A  “medium  risk”  assessment  is 
warranted  until  the  probability  decreases  below  10-6.  With  a  few  simple  assumptions  we  can  use  these 
probabilities  and  the  worst-case  TSM  thresholds  in  table  9  to  roughly  estimate  the  corresponding  nominal- 
case  TSMs.  Let’s  assume  that  the  probability  of  exceeding  the  expected  worst-case  condition  is  2  percent; 
that  one  out  of  every  fifty  attempts  will  result  in  an  actual  TSM  of  less  than  the  worst-case  TSM.  Let’s  also 
assume  that  the  distribution  of  actual  maneuver  TSMs  around  the  nominal-case  TSM  is  a  normal  (Gaussian) 
distribution.38  With  these  assumptions,  the  worst-case  TSM  is  about  two  standard  deviations  less  than  the 
nominal-case  TSM.  Using  the  cumulative  normal  distribution  function,  we  can  estimate  that  a  nominal  TSM 
of  6.9  seconds  produces  a  1(T6  chance  of  ground  impact  when  the  worst-case  TSM  is  4.0  seconds.  For  the 
high  risk  worst-case  TSM  threshold  of  2.5  seconds  and  a  10  3  chance  of  ground  impact,  the  nominal  TSM  is 
7. 1  seconds.  Paradoxically,  this  implies  that  the  presumed  risk  assessment  allows  for  less  accurate  planning 
than  the  lower,  “riskier”  TSM.  The  presumed  risk  assessments  did  not  originate  in  statistical  analysis;  they 
were  largely  based  on  the  risk  assessment  framework  provided  by  ART  (reference  3)  and  the  instincts  of  the 
authors  and  reviewers. 

If  we  push  our  statistical  assumptions  to  the  breaking  point,  we  can  determine  that  if  our  planning  and 
training  is  good  enough  to  assure  that  98  percent  of  our  actual  TSMs  will  be  within  0.5  seconds  of  the 
nominal  TSM,  the  nominal-case  TSM  for  the  medium  risk  threshold  of  a  10  6  chance  if  ground  impact 
is  about  1.2  seconds,  with  a  worst-case  TSM  of  0.7  seconds.  While  mathematically  correct,  this  shows 
the  limitations  of  our  assumptions.  A  test  team  that  tried  to  make  this  argument  would  be  castigated  for 
their  failure  to  account  for  the  many  unknowns  that  TSM  cannot  capture.  On  the  other  hand,  if  a  test  team 
must  conduct  a  test  point  that  results  in  a  worst-case  TSM  of  3.0  seconds  yet,  through  excellent  planning 
and  buildup,  can  show  that  their  nominal-case  TSM  of  4.0  seconds  (presumed  medium  risk)  is  about  two 
standard  deviations  from  their  worst-case  TSM,  they  should  be  able  to  argue  that  their  actual  risk  is  quite 
low.  (If  you  assume  a  normal  distribution  with  a  mean  of  4.0  seconds  of  TSM  and  a  standard  deviation  of 
0.5  seconds,  the  chance  of  ground  impact  (corresponding  to  TSM  <  0.0  sec  will  be  on  the  order  of  10“15. 
This  should  not  be  the  basis  for  a  “low  risk”  assessment,  but  it  is  a  start.) 

It  is  important  to  understand  that  the  “presumed  risk  assessment”  levels  in  table  9  were  not  determined 
using  any  kind  of  statistical  analysis.  They  were  based  upon  human  reaction  time  and  the  judgment  of  the 
author  and  reviewers.  The  TSM  requirements  specified  in  table  9  arc  primarily  intended  to  reduce  variability 
in  diving  maneuvers  as  the  room  for  error  diminishes,  not  to  aid  risk  assessment.  Additional  planning  can 

77  “Nominal  recovery  condition”  is  a  recovery  that  starts  exactly  as  expected  and  is  recovered  exactly  as  planned;  the  perfectly-flown 
test  point. 

,s  There  is  no  reason  to  believe  that  the  probability  distribution  of  TSM  is  Gaussian,  but  we  can  use  this  assumption  to  approximate 
the  roughly  bell-shaped  distribution  of  realized  TSMs  around  the  nominal  maneuver. 
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reduce  the  risk  of  ground  impact  even  as  the  TSM  is  diminishing;  presumed  risk  assessments  like  those  of 
table  9  should  not  be  treated  as  the  final  word. 

TSM  with  Additional  Altitude  Margins: 


Time  Safety  Margin  is  designed  to  make  altitude  margins  unnecessary  measures  of  safety.  Altitude 
margins  are  only  applicable  within  a  limited — and  often  unacknowledged  or  misunderstood — range  of  con¬ 
ditions.  The  TSM  should  be  calculated  as  a  margin  for  CFIT,  not  for  flight  through  a  minimum  altitude.  If 
operating  procedures  do  not  allow  a  maneuver  to  go  below  a  certain  AGL  altitude,  the  best  practice  is  to 
plan  the  maneuver  to  remain  above  that  altitude  but  calculate  TSM  using  the  surface  elevation.  Time  Safety 
Margin  is  the  margin  from  ground  impact,  not  from  a  violation  of  regulations. 

The  most  obvious  example  of  this  type  of  rule  is  a  specified  minimum  altitude  for  certain  types  of 
test  points.  Let’s  imagine  an  organization  that  has  the  following  directive  in  place:  “No  test  points  shall 
be  conducted  below  1 ,000  feet  AGL.”  A  rule  like  this  can  create  a  wide  range  of  problems.  On  one  end, 
1,000  feet  is  worth  about  0.5  seconds  of  TSM  in  a  Mach  2  vertical  dive  so  the  minimum  altitude  produces  an 
insignificant  amount  of  margin.  On  the  other  end,  the  minimum  altitude  ensures  about  20  seconds  of  TSM 
for  a  10-degree  dive  at  150  KTAS,  producing  inefficiency  with  excessive  margin.  Somewhere  in  the  middle, 
the  restriction  makes  sense,  but  that  somewhere  is  highly  dependent  on  airspeed,  recovery  technique,  dive 
angle,  and  so  on.  Regardless  of  regulatory  requirements,  test  teams  should  use  TSM  to  understand  their 
safety  margins  relative  to  CFIT.39 

Using  TSM  to  Scope  Planning  and  Buildup  Costs: 

Time  Safety  Margin  is  more  than  a  risk  assessment  tool;  it  may  be  used  to  help  scope  the  amount  of 
cost  and  effort  put  into  test  planning.  The  amount  of  effort  put  into  fully  understanding  the  maneuver  and 
the  aircraft,  and  into  training  the  pilot  and  test  team,  should  increase  exponentially  as  TSM  is  reduced.  At 
one  end  of  the  TSM  spectrum — at  least  8  seconds  of  TSM — any  qualified  pilot  might  be  trusted  to  plan  and 
execute  the  maneuver,  but  at  the  other  end — no  TSM — it  is  hard  to  imagine  any  amount  of  planning  that 
could  be  considered  “sufficient.”  The  guidance  provided  for  the  original  publication  of  TSM  regulations  in 
the  USAF  is  a  good  start  but  other  organizations  might  find  better — or  more  applicable — ways  to  use  TSM 
in  their  dive  planning.40 

Avoiding  Excessive  Planning  Cost  when  TSM  is  Very  High: 


Time  Safety  Margin  provides  a  very  convenient  and  effective  method  for  identifying,  understanding,  and 
controlling  risk  during  diving  maneuvers  but  attempting  to  accurately  determine  TSM  can  produce  severe 
over-planning  for  dives  with  a  high  TSM.  Consider  a  0.8  MN,  10-degree  dive  at  45,000  feet  AGL;  the 
TSM  for  this  dive  is  about  5  minutes.  (Using  800  feet  per  second  and  3,000  ft  terrain  elevation,  TSM  is 
approximately  42, 000/(800  sin  10)  =  302  seconds;  even  this  much  planning  is  arguably  overkill.)  Clearly 
there  arc  a  lot  of  dives  that  produce  such  obviously  high  TSMs  that  almost  any  effort  spent  calculating  TSM 
is  wasted. 

The  figures  in  appendix  A  provide  one  way  around  spending  too  much  time  on  TSM  when  TSM  is 
clearly  not  a  factor.  These  figures  show  the  AGL  altitude  that  corresponds  to  8  seconds  of  TSM  for  a  variety 

39  TSM  has  been  successfully  used  to  ease  the  process  of  obtaining  a  waiver  for  onerous  or  inapplicable  regulatory  requirements. 

40  When  AFMC  adopted  TSM,  the  published  guidance  for  “Automatic  Recovery  TSM”  (1.5>TSM>0  seconds)  was  changed  to 
“Not  Authorized.”  This  had  the  effect  of  elevating  the  approval  authority  for  this  type  of  test  by  requiring  a  testing  agency  to  seek 
a  waiver  if  a  TSM  of  less  than  1 .5  seconds  was  required  for  their  program. 
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of  bank  angles  and  recovery  load  factors,  from  Mach  0.15  through  Mach  2.  If  the  planned  test  procedure 
and  recovery  clearly  lie  within  the  assumptions  for  these  charts  and  the  planned  minimum  recovery  start 
altitude  is  less  than  that  shown  for  8  seconds  of  TSM,  then  TSM  planning  may  be  considered  complete.41 
These  figures  arc  divided  into  three  sets;  wings-level  dives,  90-degree  bank  dives,  and  inverted  dives. 

Figure  23  is  provided  here  as  an  example.  The  platform-independent  predictions  on  this  figure  assume  a 
constant  Mach  number  for  the  entire  maneuver  (Mach  is  found  on  the  horizontal  axis),  a  wings  level  steady- 
state  dive  prior  to  the  recovery  start  altitude  shown  on  the  vertical  axis,  and  no  unplanned  delay.  Mach  and 
recovery  start  altitude  arc  given  on  logarithmic  scales.  It  takes  3  seconds  to  achieve  6  g  from  the  steady-state 
Nz  for  each  dive  angle.  Reference  lines  for  seven  dive  angles  arc  used  to  depict  the  altitude/Mach  number 
combinations  that  result  in  8  seconds  of  TSM. 

For  example,  assume  a  steady  wings-level  dive  procedure  that  has  a  minimum  altitude  of  10,000  feet 
AGL,  a  maximum  Mach  of  0.9,  and  a  maximum  dive  angle  of  30  degrees.  Find  the  point  on  the  chart  at 
the  intersection  of  0.9  MN  and  10,000  feet.  Note  that  this  point  is  well  above  the  8  second  TSM  line  for  a 
30-degree  dive.  This  means  that  the  TSM  is  greater  than  8  seconds  provided  the  conditions  and  assumptions 
are  met.  If  the  recovery  is  started  at  5,000  feet  in  an  otherwise  similar  dive,  the  chart  shows  that  a  30-degree 
dive  would  be  too  steep  for  8  seconds  of  TSM  while  a  20-degree  dive  would  provide  at  least  8  seconds  of 
TSM. 

Maneuvers  in  Low  Visibility  and  at  Night: 


Time  Safety  Margin  is  only  defined  by  the  planned  maneuver.  Strictly  speaking,  so  long  as  the  pilot  has 
the  tools  and  skills  necessary  to  fly  the  procedure  and  recovery,  the  TSM  will  not  be  changed  by  the  amount 
of  ambient  lighting  or  the  pilot’s  view  of  the  ground.  (Although  visual  cues  can  provide  a  low-resolution 
and  better-than-nothing  backup  to  missing  required  recovery  initiation  parameters,  TSM  must  not  be  based 
in  any  way  upon  the  pilot  using  visual  cues  like  “ground  rush”  to  determine  when  recovery  is  required.) 

The  risks  presented  by  low  visibility  and  night  conditions  do  not  have  anything  to  do  with  the  geometry 
of  the  procedure  or  the  dive  recovery;  the  risks  are  almost  entirely  the  result  of  the  potential  for  pilot  spatial 
disorientation.  The  pilot  might  have  all  the  information  he  needs  to  accomplish  a  safe  recovery,  but  without 
the  help  of  a  visible  horizon  he  is  much  more  likely  to  subconsciously  misinterpret  somatosensory  and 
vestibular  cues — to  experience  spatial  disorientation.  A  disoriented  pilot  is  much  less  likely  to  correctly 
interpret  the  instruments  and  fly  the  recovery  as  designed;  in  fact,  a  disoriented  pilot  is  much  more  likely  to 
make  the  situation  much  worse.  A  disoriented  pilot  may  be  no  more  capable  of  recovering  correctly  than  an 
unconscious  pilot. 

The  bulk  of  the  effort  put  into  planning  night  or  low-visibility  diving  maneuvers  should  be  spent  on 
preventing,  identifying,  and  recovering  from  spatial  disorientation.  The  less  likely  the  pilot  is  to  become 
disoriented,  the  more  reasonable  it  is  to  use  TSM  thresholds  designed  for  clear  daytime  skies.  Maneuvers 
must  be  designed  to  minimize  the  chance  of  disorientation  and  to  provide  a  backup  plan  that  does  not  rely 
on  the  pilot  regaining  orientation. 

When  designing  for  a  successful  night  or  low-visibility  dive  and  dive  recovery,  avoid  high  Nz,  high  roll 
rate,  and  high  roll  acceleration.  Inverted  flight  is  particularly  problematic  but  any  roll  angle  higher  than 
about  30  degrees  will  add  risk.  Technology  like  night  vision  goggles  can  help,  of  course,  but  the  pilot  must 

41  This  argument  follows  from  the  idea  that  8  seconds  of  TSM  is  typical  of  the  minimum  margin  routinely  used  in  basic  operational 
flying  by  qualified  pilots.  With  this  much  margin,  you  should  be  able  to  rely  upon  operationally-developed  judgment  for  dive 
recovery  safety. 
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8.0  Second  TSM  Estimate  for  6.0  g  Constant  Mach  Recovery 


(aoepns  |0A8|  eas  ‘Aep  pjs  ‘“ISIAI  U)  9Pnl!W 


47 


Figure  23  Eight  Second  TSM  Estimates  for  a  6-g  Recovery  from  a  Wings-Level  Dive 


have  the  correct  training  in  their  use.  If  the  aircraft  has  a  pilot-activated  automatic  recovery  system,  planning 
to  use  that  system  instead  of  a  pilot-flown  recovery  could  be  beneficial.  If  the  cockpit  has  more  than  one 
set  of  controls,  a  safety  pilot  may  be  assigned  with  the  primary  role  of  maintaining  attitude  awareness  and 
recovering  as  required.  A  control  room  can  help  with  maneuver  setup  and  recovery  calls,  but  probably 
cannot  help  much  with  the  actual  recovery. 

Time  Safety  Margin  is  perfectly  valid  for  night  and  low-visibility  testing,  but  the  minimum  TSM  for  the 
maneuver  must  be  adjusted  upward  as  the  probability  of  pilot  spatial  disorientation  increases.  It  is  probably 
better  to  concentrate  on  preventing  disorientation,  not  on  trying  to  figure  out  how  much  TSM  is  required 
for  a  disoriented  pilot;  if  you  think  the  pilot  may  become  incapacitated  by  disorientation,  you  have  a  much 
bigger  problem  than  TSM. 

Reality  Check — There  is  no  “Universal”  Solution  for  Dive  Planning: 


It  is  impossible  to  perfectly  calculate  TSM.  Time  Safety  Margin  is  a  tool  to  help  plan  diving  maneuvers, 
it  is  not  a  deterministic  means  of  characterizing  dive  maneuver  risk;  it  is  not  a  “law  of  nature.”  TSM  should 
be  based  on  the  worst-case  abort  scenario  combined  with  a  reasonable,  reliable,  and  conservative  recovery 
profile  so  that  there  is  sufficient  margin  for  the  many  ways  that  the  actual  maneuver  will  differ  from  the  plan. 
The  uncertainty  inherent  in  any  TSM  calculation  means  that  TSM  time  range  requirements  should  not  be 
seen  as  definitive  goals,  but  as  thresholds  to  rationally  drive  planning  effort  and  risk  mitigation.  Time  Safety 
Margin  should  be  used  as  a  tool  to  improve  the  process  of  planning  diving  maneuvers,  not  as  a  means  of 
encouraging  arbitrary  decision-making. 
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TSM  EXAMPLES 


These  examples  will  be  presented  primarily  with  the  use  of  TSM  Awareness  Tool  estimations.42  These 
examples  arc  intended  to  help  the  reader  better  understand  TSM  in  general  and  their  dive  recovery  problem 
in  particular,  not  to  provide  a  recipe  for  every  class  of  recovery. 

WINGS-LEVEL  DIVES 

Using  a  Flight  Manual  to  Estimate  TSM: 


If  the  TSM  will  be  high  enough  (the  original  AFFTC  instructions  drew  the  line  at  8  seconds  for  “routine” 
TSM),  it  is  reasonable  to  determine  TSM  using  available  data,  such  as  flight  manual  dive  recovery  tables. 
For  a  wings-level  dive,  a  simple  back-of-an-envelope  calculation  should  produce  results  that  arc  accurate 
enough  to  ensure  the  TSM  is  significantly  greater  than  8  seconds. 

Flight  manual  dive  recovery  charts  arc  typically  designed  to  give  the  altitude  lost  during  a  dive  recovery 
using  the  conditions  at  the  initiation  of  the  recovery  including  airspeed  and/or  Mach,  initial  altitude,  dive 
angle,  and  recovery  load  factor  (Nz  in  units  of  g).  It  is  a  simple  matter  to  calculate  how  long  it  would  take 
to  get  from  the  planned  recovery  initiation  altitude  to  the  AGL  altitude  equal  to  the  expected  altitude  lost  in 
the  dive. 


TSM  Planned  Recovery  Initiation  Altitude  -  Minimum  Recovery  Initiation  Altitude 

Average  True  Airspeed  x  sin  (Dive  Angle) 

Keep  in  mind  that  the  method  chosen  to  calculate  TSM  will  affect  the  uncertainty  of  that  calculation.  If 
the  TSM  calculation  carries,  say,  a  1  second  uncertainty,  it  is  more  than  accurate  enough  for  a  20  second 
TSM  calculation  but  completely  inadequate  for  a  2  second  TSM.  The  original  AFFTC  TSM  requirements 
reflect  this  in  the  “planning  fidelity”  requirements  for  different  amounts  of  TSM  (table  9).  It  is  extremely 
important  to  employ  sufficient  planning  for  a  hazardous  dive,  but  it  is  also  important  for  help  control  cost 
and  schedule  risk  by  not  employing  excessive  fidelity  for  dives  that  have  ample  TSM. 


42  The  “TSM  Awareness  Tool”  is  a  Matlab  graphical  user  interface  designed  to  provide  a  3D  physics-based  estimation  of  TSM.  The 
user  manual  is  located  in  appendix  C. 
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Weapons  Delivery  (Figure  24): 


This  scenario  is  for  a  30-degree  diving  delivery  at  450  KCAS,  releasing  at  4,000  ft  AGL  over  a  sea-level 
target.  Operational  requirements  call  for  terminating  the  delivery  procedure  and  recovering  if  the  airspeed  is 
50  KCAS  fast,  if  the  dive  is  more  than  5-degrees  steep,  or  if  the  minimum  release  altitude  of  3,700  ft  AGL  is 
passed.  As  is  routine  with  a  weapons  delivery,  the  recovery  is  delayed  for  one  second  after  release.  With  this 
information,  TSM  is  based  on  the  worst-case  recovery  conditions  of  a  35-degree  dive  at  500  KCAS  with  the 
release  occurring  at  the  minimum  altitude  of  3,700  ft.  The  resulting  TSM  is  3.1  seconds.  This  TSM  seems 
low,  but  it  is  typical  for  this  type  of  diving  weapons  delivery;  it  reflects  the  amount  of  training  and  planning 
these  maneuvers  require  of  operational  pilots. 

If  the  exact  planned  parameters  are  used  to  calculate  TSM  the  result  is  almost  twice  as  long,  giving  the 
impression  that  the  delivery  procedure  is  much  less  hazardous  than  it  actually  is  or — more  precisely — could 
be  when  correctly  flown  within  maneuver  limitations.  This  is  a  good  illustration  of  why  you  must  always 
use  the  worst-case  recovery  parameters  and  abide  by  criteria  that  require  procedure  termination  if  any  of 
these  parameters  arc  exceeded. 


Figure  24  Example:  Diving  Weapons  Delivery 
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Ground  Proximity  Warning  Test  (Figure  25): 


One  of  the  most  valuable  uses  of  the  TSM  methodology  is  to  eliminate  unnecessary  buildup.  Pilots  tend 
to  think  of  altitude  lost  or  minimum  altitude  as  the  best  metric  for  ensuring  safety  during  dive  recoveries, 
but  we  have  seen  that  this  intuition  is  false.  One  thousand  feet  of  buffer  may  be  plenty  for  one  maneuver  but 
completely  meaningless  for  another.  This  example  depicts  what  would  appear  to  be  a  steep  dive  for  a  large 
aircraft  on  a  fairly  fast  final.  The  initial  conditions  are  a  10-degree  dive  at  145  KCAS  and  500  feet  AGL. 
One  second  of  planned  delay  is  added  for  pilot  response  time  and  just  1.5  g  is  planned  for  recovery.  For  this 
situation,  TSM  is  a  relatively  generous  8.7  seconds. 

Of  course,  this  assumes  that  everything  goes  exactly  as  planned.  If  you  assume  that  the  dive  angle  might 
be  as  much  as  2  degrees  too  steep,  the  speed  10  KCAS  fast,  and  the  delay  time  for  recovery  as  long  as 
2  seconds,  you  will  need  to  add  a  few  hundred  feet  to  the  planned  recovery  altitude  to  ensure  a  TSM  of  at 
least  8  seconds. 


Figure  25  Example:  Low  Speed  GPWS  Test 
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USAF  Test  Pilot  School  Shuttle  Approach  Simulation  (Figure  26): 


At  the  start  of  the  Space  Shuttle  program,  astronauts  trained  to  fly  the  Shuttle  final  approach  and  flare 
using  a  T-38  Talon  trainer  aircraft.  This  profile  was  adopted  by  the  USAF  Test  Pilot  School  (TPS)  to  support 
the  aircraft  performance  curriculum  and  remains  an  event  that  all  students  fly.  The  Space  Shuttle  final 
approach  was  very  steep  and  very  fast,  but  the  T-38  can  fly  steeper  and  faster  when  light-weight.  There  are 
limitations  on  the  dive  angle  and  airspeed  (30  degrees  and  300  KCAS,  respectively)  and  when  the  aircraft 
is  flown  at  these  limitations  and  the  flare  is  started  at  the  minimum — and  normal — flare  altitude  of  1 ,000  ft 
AGL,  the  TSM  is  only  2  seconds.  It  is  very  difficult  to  get  this  steep  without  exceeding  the  airspeed  limit  of 
300  KCAS  so  this  scenario  is  highly  unlikely.  Under  nominal  approach  conditions  at  the  lowest  allowable 
weight  the  TSM  is  4.4  seconds  (corresponding  to  a  24-degree  dive  at  275  KCAS). 

All  landings  involve  a  descent  close  to  the  ground;  the  margin  between  the  start  of  a  normal  flare  and  the 
point  at  which  a  hard  landing  is  assured  is  typically  not  much  more  than  a  few  seconds.  This  is  why  pilots 
spend  a  lot  of  time  training  to  land  their  aircraft  and  practice  landings  regularly.  Very  short  TSMs  can  be 
perfectly  reasonable,  but  only  at  the  cost  of  training  and  practice.  The  USAF  TPS  shuttle  approach  profile 
requires  a  special  pilot  checkout  program  and  must  be  practiced  by  each  qualified  pilot  at  least  once  every 
six  months. 


Figure  26  Example:  USAF  Test  Pilot  School  “Shuttle  Approach” 
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INVERTED  OR  TURNING  DIVES 


High  Mach  Split-S,  High  Thrust  (Figure  27): 

A  split-s  procedure  offers  additional  dive  recovery  risks.  During  the  procedure  the  dive  angle  is  rapidly 
increasing  so  any  unplanned  delay  past  the  intended  maximum  dive  angle  rapidly  decreases  the  ITSM. 
This  example  gives  a  comfortable  7.1  seconds  of  ITSM  when  recovering  from  the  planned  maximum  dive 
angle  of  -30  degrees.  But  each  second  of  unplanned  delay  at  the  initial  N-  decreases  the  ITSM  by  more  than 
3  seconds.  It  only  takes  about  2.2  seconds  of  unplanned  delay  for  the  ITSM  to  go  to  nil;  therefore  the  DTSM 
is  a  very  short  2.2  seconds.  Put  more  directly,  if  the  pilot  continues  pulling  for  a  little  more  than  2  seconds 
past  the  planned  maximum  dive  angle,  executing  the  planned  recovery  will  result  in  ground  impact. 

One  of  the  reasons  that  the  DTSM  for  this  maneuver  is  so  low  is  that  it  is  built  around  the  assumption 
that  the  thrust  is  set  such  that  the  airspeed  would  remain  roughly  constant  in  a  level  turn  at  the  recovery  Nz. 
As  the  aircraft  is  unloaded  and  rolled  during  the  dive,  the  Mach  number  rapidly  builds  to  a  maximum  of 
1.3  MN  from  the  initial  0.9  MN.  This  increases  the  turn  radius  and  the  altitude  lost  during  the  recovery.  It  is 
also  not  very  realistic,  as  the  very  simple  energy  approximation  algorithm  does  not  take  into  account  wave 
drag.  (On  the  other  hand,  it  is  conservative;  the  TSM  using  actual  aircraft  performance  would  probably  be 
significantly  higher.) 


Figure  27  Example:  Split-S  Procedure  with  High  Thrust 
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High  Mach  Split-S,  Low  Thrust  (Figure  28): 


If  we  run  the  same  scenario  as  the  high-thrust  split-s  procedure,  but  with  the  energy  approximation  set 
to  approximate  a  minimum  power  setting  in  a  fighter  aircraft,  we  get  significantly  improved  results  from  the 
same  initial  conditions.  Although  the  ITSM  decreases  about  8  seconds,  the  DTSM  only  decreases  to  4.9 
seconds  and  there  is  no  unplanned  delay  that  results  in  an  unrecoverable  condition  (ITSM<0  seconds). 

The  DTSM  graph  has  some  interesting  discontinuities.  These  correspond  to  how  the  unplanned  delay 
affects  the  recovery  algorithm.  In  the  first  section,  up  to  about  2  seconds  of  unplanned  delay,  the  dive 
recovery  is  as  expected;  the  aircraft  Nz  is  reduced  then  it  is  rolled  to  wings  level  and  loaded  up  to  the 
recovery  Nz.  The  last  section  corresponds  to  where  the  planned  delay  causes  the  aircraft  to  be  pulled  past 
the  vertical.  Once  this  happens,  the  aircraft  is  just  unloaded  directly  to  the  recovery  Nz  without  producing 
the  altitude  loss  caused  by  unloading  to  the  low  rolling  Nz.  The  middle  section  results  from  the  aircraft 
passing  the  nadir  while  being  unloaded  to  the  rolling  N-  then,  after  unloading  for  the  roll  and  finding  that 
there  is  no  need  to  roll,  the  pilot  immediately  pulls  to  the  recovery  Nz. 


Figure  28  Example:  Split-S  Procedure  with  Low  Thrust 
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High  Mach  Split-S,  High  Thrust  Pulled-Through  (Figure  29): 


Sometimes  a  standard  dive  recovery  is  a  bad  idea.  This  example  shows  what  happens  when  we  take  the 
very  worrisome  “Split-S  Procedure,  High  Thrust”  case  and  just  set  it  up  to  continue  the  on-conditions  pull 
of  9  g.4’  By  just  continuing  the  pull  until  level  flight  the  DTSM  is  now  a  very  reasonable  5.5  seconds. 

There  arc  other  factors  to  consider  for  this  particular  maneuver,  though.  Most  importantly,  this  has 
the  pilot  at  9  g  for  about  12  seconds  so  you  have  to  account  for  that  in  your  planning.  If  the  pilot  loses 
consciousness  during  a  split-s  procedure,  the  TSM  probably  doesn’t  matter! 


Figure  29  Example:  Split-S  Procedure,  Pulled  Through  with  High  Thrust 


43  In  GUI,  this  is  done  by  changing  both  “T ’  to  skip  unload  to  rolling  Nz”  and  “T ’  to  skip  roll”  to  “1,”  then  changing  the  recovery 
Nz  to  match  the  initial  Nz. 
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Wind-Up  Turn  (Figure  30): 


This  scenario  illustrates  a  wind-up  turn.  It  assumes  that  the  minimum  altitude  (bottom  of  the  data 
band)  is  8,000  ft  MSL,  5,000  feet  above  the  surface  elevation  of  3,000  ft  MSL.  The  maximum  airspeed  is 
250  KCAS,  the  maximum  allowable  dive  angle  is  45  degrees,  and  the  maximum  bank  angle  is  90  degrees. 
This  maneuver  results  in  an  ample  ITSM  of  9.6  seconds.  The  DTSM  is  also  9.6  seconds  but,  thanks  to  the 
dynamics  of  the  maneuver,  the  ITSM  actually  improves  if  the  pilot  delays  past  the  expected  delay  of  one 
second. 

You  can  check  the  sensitivity  of  DTSM  and  ITSM  to  changes  in  the  entry  parameters  by  making  small 
changes  in  each  parameter — only  one  parameter  at  a  time — and  running  the  simulation  to  see  how  it  affects 
the  TSM.  For  instance,  in  this  scenario  an  increase  of  5  degrees  to  the  initial  dive  angle  results  in  a  one 
second  reduction  in  TSM.  Adding  10  degrees  of  bank  has  about  the  same  effect.  It  would  seem  that  a  small 
decrease  in  recovery  Nz  would  have  about  the  same  effect,  but  Nz  is  not  a  critical  part  of  this  recovery;  the 
recovery  Nz  must  be  reduced  from  5  g  to  about  2.4  g  to  have  the  same  effect  on  TSM  as  the  10-degree  bank 
or  5-degree  dive  changes.  Increasing  the  recovery  Nz  to  9  g  only  improves  the  TSM  by  about  a  tenth  of  a 
second;  the  recovery  is  complete  when  the  aircraft  hits  about  7  g  so  it  never  reaches  9  g. 


Figure  30  Example:  Wind-Up  Turn 
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Inverted,  Negative  Cockpit  Nz  (Figure  31): 


Sometimes  sustained  negative  Nz  flight  is  required.  Sometimes  it  has  to  be  at  low  altitude.  The  TSM 
considerations  can  be  very  interesting.  Figure  31  depicts  a  profile  that  assumes  a  minimum  altitude  of 
3,000  ft  AGL,  maximum  dive  angle  of  10  degrees,  and  a  minimum  Nz  of  -0.5  g.  At  these  conditions,  the 
dive  angle  will  be  increasing  slightly  and  the  pilot  must  return  to  1  g  to  roll.  The  former  means  that  the 
DTSM  is  less  than  the  ITSM  with  no  unplanned  delay  (the  pilot  may  persist  in  the  initial  conditions  for 
4. 1  seconds  before  recovery  as  planned  becomes  doubtful)  and  the  latter  means  that  the  pilot  must  increase 
the  dive  angle  by  pulling  to  1  g  prior  to  rolling  from  inverted.  For  the  no-unplanned-delay  case,  this  means 
that  the  maximum  dive  angle  is  16  degrees.  At  any  rate,  the  overall  minimum  DTSM — and  overall  TSM- 
for  this  maneuver  is  4. 1  seconds. 

This  example  illustrates  the  importance  of  having  and  abiding  by  relevant  worst-case  conditions.  If  the 
recovery  is  not  initiated  for  a  steeper- than-  10-degree  dive  angle  then  the  reasonable  TSM  is  no  longer  valid 
and  recovery  could  be  impossible  in  just  a  few  seconds.  Pilot  technique  will  also  be  important  here;  if  the 
pilot  has  practiced  inverted  level  flight  this  should  be  a  very  easy  test  point  to  achieve.  If  not,  the  test  team 
better  be  ready  to  call  “Knock-it-off !” 


Figure  31  Example:  Low  Altitude  Negative  Nz  Test  Point 
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T-38  Excess  Bank  in  the  Final  Turn  (Figure  32): 


The  early  history  of  the  T-38  Talon  was  rife  with  fatal  accidents  in  the  pattern  (reference  9).  In  an 
overhead  pattern,  the  final  turn  from  downwind  to  final  approach  is  flown  in  landing  configuration,  20  KCAS 
faster  than  final  approach  speed.  About  7  degrees  of  dive  is  required  to  make  it  to  final  approach  at  the  right 
altitude.  At  these  airspeeds  the  T-38  does  not  have  much  Nz  available  for  maneuvering  so  if  the  pilot  allows 
the  descent  rate  to  become  excessive,  either  by  flying  too  slowly  or  by  using  too  much  bank  angle  for  the 
N-,  the  aircraft  can  rapidly  reach  an  unrecoverable  situation. 

We  can  use  TSM  (particularly  DTSM)  to  look  at  the  case  of  excessive  bank  in  the  final  turn.  Figure  32 
is  set  up  to  roughly  approximate  a  situation  where  a  pilot  has  recognized  tight  spacing  about  one-third  of  the 
way  through  a  normal  final  turn  and  inadvertently  increased  the  bank  angle  to  90  degrees  while  maintaining 
the  Nz  required  for  a  50-degree-bank  turn.  With  no  lift  countering  the  weight  of  the  aircraft,  it  immediately 
begins  to  accelerate  toward  the  ground  at  1  g.  If  the  pilot  immediately  recognizes  his  oversight  and  recovers, 
the  ITSM  is  1 1.2  seconds;  a  very  comfortable  margin.  If  the  pilot  fails  to  recognize  the  increasing  dive  angle 
(the  more  likely  case),  the  minimum  DTSM  is  just  2.7  seconds;  failure  to  roll  out  for  only  2.7  seconds  will 
result  in  an  unrecoverable  dive! 


Figure  32  Example:  T-38  Over-Banked  Final  Turn 
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ADVANCED  APPLICATIONS 


Time  Safety  Margin  is  normally  the  consequence  of  a  worst-case  maneuver;  it  is  something  you  calculate 
from  a  planned  condition.  But  TSM  may  also  be  used  to  help  understand  the  relative  risk  of  pilot  errors  in 
an  otherwise  perfectly  routine  maneuver.  In  other  words,  although  TSM  is  not  defined  for  level  flight  at 
500  ft  AGL,  it  can  provide  a  tool  to  look  at  mistakes  that  will  result  in  a  dive.  What  if  the  pilot  unloads 
to  less  than  1  g?  How  much  is  too  much?  How  long  is  too  long?  If  the  pilot  is  turning,  what  arc  the 
consequences  of  not  using  enough  Nz  to  keep  the  aircraft  level?  By  applying  DTSM  and  mapping  out  the 
resulting  TSM  for  errors  like  these,  we  can  gain  an  appreciation  of  the  relative  consequences  of  various 
errors. 

Low-Level  Wings-Level  Flight: 


Tables  9  and  10  depict  how  the  TSM  changes  for  combinations  of  cockpit  Nz  and  Mach  numbers  starting 
from  level  flight.44  If  we  assume  that  the  aircraft  stalls  in  level  flight  and  the  pilot  immediately  unloads,  it  is 
cleai-  that  the  aircraft  will  eventually  hit  the  ground.  How  much  less  than  1  g  is  too  much?  By  calculating  the 
TSM  for  a  maneuver  that  stalls  in  level  flight  at  a  given  Nz,  assuming  that  the  pilot  immediately  perceives  the 
unloaded,  increasing  dive  angle  condition,  we  can  calculate  the  ITSM  for  the  resulting  maneuver.  Table  9 
shows  the  TSM  for  this  situation;  an  immediately  recognized  unloaded  condition  followed  by  an  immediate 
recovery.  These  numbers,  all  greater  than  13  seconds  for  a  wide  range  of  Mach  numbers  and  up  to  -1  g, 
indicate  that  an  alert  pilot  has  ample  time  to  recovery  from  the  unloaded  condition.  These  results  make 
low-level  flight  look  much  safer  than  it  feels. 


Table  9  TSM  for  a  Momentary  Wings-Level 
Push-Over  from  500  Ft  AGL 


TSM  (sec) 

Mach  Number 

0.25 

0.5 

0.75 

1 

2 

Nz(g) 

0.5 

230.4 

230.4 

230.4 

230.4 

230.4 

0.0 

59.2 

59.2 

59.2 

59.2 

59.2 

-0.5 

25.9 

25.9 

25.9 

25.9 

25.9 

-1.0 

14.0 

13.9 

13.9 

13.9 

13.9 

Table  10  shows  the  DTSM  for  the  same  situation;  in  this  case  depicting  how  long  the  push  may  be 
maintained  until  0  ITSM  is  encountered  and  the  planned  dive  recovery  results  in  ground  impact.  These 
numbers  are  much  smaller;  even  a  0.5-g  push  results  in  less  than  8  seconds  of  TSM.  If  the  pilot  persists  in 
an  error — a  more  likely  event  since  pilots  will  typically  only  push  forward  intentionally — there  is  very  little 
margin  to  prevent  disaster.  These  numbers  subjectively  correlate  with  the  amount  of  training  required  for 
pilots  to  be  qualified  for  low  level  flight. 

You  have  probably  noted  that  the  TSM  and  DTSM  numbers  are  essentially  the  same  regardless  of  Mach 
number.  This  is  a  consequence  of  the  effect  of  airspeed  on  the  turn  rate.  At  low  speed,  the  aircraft  dive 
angle  decreases  much  more  quickly  than  high  speed  and  the  dive  recovery  for  a  given  dive  angle  takes  less 
altitude.  The  faster  the  aircraft  is  traveling,  the  shallower  the  TSM-defining  dive  angle. 

44  —y0  =  0  deg,  0O  =  0  deg,  h0  =  500  feet  MSL,  Nz0  =  [variable],  M0  =  [variable],  tj  =  0  sec,  Nz  =  2  g/sec,  Nz ^  =  1  g, 
0  =  90  deg/sec,  NZr  =  4  g,  hg  =0  feet  MSL,  constant  Mach. 
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Table  10  Minimum  DTSM  for  a  Sustained 
Wings-Level  Push-Over  from  500  ft  AGL 


Min  DTSM  (sec) 

Mach  Number 

0.25 

0.5 

0.75 

1 

2 

0.5 

6.8 

6.6 

6.6 

6.6 

6.5 

Nz{, g) 

0.0 

4.1 

4.1 

4.0 

4.0 

4.0 

-0.5 

2.9 

2.9 

2.8 

2.8 

2.8 

-1.0 

2.2 

2.2 

2.1 

2.1 

2.1 

Low-Level  Turning  Flight: 


We  can  apply  a  similar  analysis  for  turning  flight.  For  any  given  bank  angle,  there  is  a  cockpit  N-  that 
corresponds  to  level  flight  (Nz  [in  g]  =  1  /  cos  <f>)  so  if  the  pilot  is  not  at  0-degrees-bank  angle  at  1  g,  the  dive 
angle  will  be  increasing.  Tables  1 1  and  12  depict  how  the  ITSM  and  DTSM  differ  for  combination  of  bank 
angles  and  Mach  numbers  starting  at  500  ft  AGL  and  1  g.45 


Table  1 1  TSM  for  Non-Zero  Bank  Angles  at  1  g 
(500  ft  AGL) 


TSM  (sec) 

Mach  Number 

0.25 

1 

2 

60 

128.2 

128.1 

128.1 

75 

67.8 

67.8 

67.7 

Bank  (deg) 

90 

40.5 

40.4 

40.4 

135 

12.8 

12.8 

12.8 

180 

5.5 

5.3 

5.3 

Table  12  Minimum  DTSM  for  Non-Zero  Bank 
Angles  at  1  g  (500  ft  AGL) 


Min  DTSM  (sec) 

Mach  Number 

0.25 

1 

2 

60 

6.7 

6.2 

6.3 

75 

5.1 

4.6 

4.6 

Bank  (deg) 

90 

3.9 

3.7 

3.7 

135 

2.0 

2.2 

2.2 

180 

1.6 

1.3 

1.3 

As  with  a  wings-level  push,  the  TSM  does  not  look  too  bad — even  for  180  degrees  of  bank  (inverted 
flight) — because  the  TSM  assumes  that  the  recovery  begins  with  no  delay.  By  adding  delay  and  calculating 
TSM  using  DTSM  we  can  see  that  the  time  to  an  unrecoverable  condition  becomes  very  short  at  more 
than  90  degrees  of  bank.  This  conforms  well  with  low-level  training  rules  that  often  make  bank  angles  in 
excess  of  90  degrees  either  illegal  or  only  allowed  in  very  specific  cases,  such  as  a  ridge  crossing  where  the 

45  -yo  =  0  deg,  (/>o  =  [variable],  ho  =  500  feet  MSL,  Nz0  =  1  g,  Mo  =  [variable],  tj  =  0  sec,  Nz  =  2  g/sec,  NZlp  =  1  g,  0  =  90  deg/sec, 
NZr  =  4  g,  h$  =0  feet  MSL,  constant  Mach. 
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aircraft  must  be  rolled  inverted  to  prevent  excessive  altitude  gain  after  climbing  with  terrain.  (During  a  ridge 
crossing,  the  aircraft  is  typically  at  a  fairly  high  climb  angle  and  transitioning  to  descending  terrain.  This 
means  that  there  should  be  adequate  margin  with  proper  training  and  currency.) 
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CONCLUSION 


Traditionally,  pilots  have  thought  of  dive  recovery  margin  primarily  in  terms  of  minimum  altitudes 
and  maximum  dive  angles.  These  parameters  work  for  normal  operations  because  most  flying  involves 
repetition  of  routine  tasks.  Flight  test  maneuvers  often  involve  procedures  that  have  little  operational  use 
but  arc  necessary  to  investigate  particular  aspects  of  an  aircraft’s  characteristics.  These  procedures  arc  in  no 
way  routine,  nevertheless  the  standard  dive  recovery  conventions  can  provide  a  sense  of  comfort  when  none 
is  warranted.  By  quantifying  the  essence  of  what  really  matters — the  time  the  test  team  has  to  err  in  the 
worst-case  condition  and  at  the  worst-case  recovery  initiation  point — Time  Safety  Margin  serves  as  a  metric 
that  can  be  used  to  determine  a  consistent  and  accurate  measure  of  safety  margin  for  both  conventional  and 
unconventional  diving  maneuvers.  At  the  AFTC,  TSM  has  improved  test  efficiency  by  setting  a  universal 
standard  for  “routine”  dives.  This  standard  has  substantially  reduced  the  amount  of  time  and  effort  put  into 
dive  planning  and  buildup  for  shallow  dives  conducted  below  traditional  minimum  altitude  restrictions.  Time 
Safety  Margin  has  also  been  successfully  used  for  complex  dives  at  very  high  speeds,  encouraging  test  teams 
to  find  procedures,  recoveries,  techniques,  and  locations  that  increase  TSM.  Finally,  TSM  provides  a  clear 
path  to  risk  minimization  and  approval  for  elevated-risk  points.  There  arc,  no  doubt,  further  improvements 
that  may  be  made  to  TSM  methodology,  but  TSM  as  implemented  at  the  AFTC  has  been  found  to  encourage 
and  enable  rational,  effective,  and  efficient  risk  reduction  measures. 
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APPENDIX  A  -  CHARTS  FOR  ESTIMATING  8  SECONDS  OF  TSM 


Time  Safety  Margin  provides  a  very  convenient  and  effective  method  for  identifying,  understanding,  and 
controlling  risk  during  diving  maneuvers,  but  attempting  to  accurately  determine  TSM  can  produce  severe 
over-planning  for  dives  with  a  very  high  TSM. 

These  figures  provide  one  way  around  spending  too  much  time  finding  TSM  when  TSM  will  clearly  not 
drive  additional  dive  planning  (generally,  when  it  is  8  seconds  or  more).1  These  figures  show  the  AGL  alti¬ 
tude  that  corresponds  to  8  seconds  of  TSM  for  a  variety  of  bank  angles  and  recovery  load  factors.  Constant 
Mach  is  assumed  throughout  with  with  Mach  0.15  through  Mach  2  provided  in  the  charts.  Unplanned  delay 
past  the  planned  recovery  worst-case  condition  is  assumed  to  be  nil;  these  charts  do  not  account  for  DTSM. 
If  the  planned  test  procedure  and  recovery  clearly  lie  within  the  assumptions  for  these  charts  and  the  planned 
minimum  recovery  start  altitude  is  less  than  that  shown  for  8  seconds  of  TSM,  then  TSM  planning  should 
be  considered  complete. 

These  constant-Mach  figures  are  divided  into  three  sets;  wings-level  dives,  90-degree  bank-angle  dives, 
and  inverted  dives.  The  constant-Mach  assumption  works  very  well  for  dive  recoveries  that  do  not  take 
much  time,  such  as  shallow  dives  and  high  Nz  dive  recoveries.  Longer  dive  recoveries — taking  as  long  as  75 
seconds  for  a  1.5-g  recovery  from  90-degrees  dive  angle  at  50,000  feet — small  deviations  from  the  recovery 
assumptions  can  significantly  reduce  the  predicted  TSM.  Engineering  judgment  is  required;  as  the  planned 
minimum  altitude/Mach  number  gets  close  to  the  8  second  TSM  line,  the  potential  for  producing  an  actual 
TSM  significantly  less  than  8  seconds  increases  with  Mach  number,  altitude,  and  reduced  recovery  Nz. 

Figures  A1  through  A4  show  the  Mach/AGL  altitude  combinations  for  wings-level  dives  across  a  variety 
of  dive  angles.  These  charts  assume  that  the  dive  recovery  is  begun  at  a  steady-state  condition  (constant  dive 
angle,  constant  Mach)  and  the  recovery  is  accomplished  at  constant  Mach  using  the  Nz  and  Nz  rate  depicted 
in  the  figure. 

Figures  A5  through  A8  show  the  Mach/AGF  altitude  combinations  for  a  variety  of  dive  angles  when  the 
initial  bank  angle  is  90  degrees  and  the  initial  Nz  is  the  same  as  the  recovery  Nz.  Each  of  these  charts  is  for 
a  different  recovery  Nz,  the  average  roll  rate  and  Nz  rate  is  reduced  with  the  recovery  Nz  to  roughly  equate 
to  the  reduced  roll  rates  and  Nz  onset  rates  that  might  be  expected  for  aircraft  with  relatively  low  recovery 
Nz  capacity.  The  odds  of  an  actual  test  point  meeting  these  parameters  is  very  small,  but  by  choosing  a 
clearly  conservative  situation  in  the  figures  and  showing  that  the  planned  recovery  altitude  is  greater  than 
the  predicted  8  second  TSM  altitude  shown  in  the  figure,  a  planner  can  confidently  claim  that  at  least  8 
seconds  of  TSM  is  available  and  that  TSM  planning  is  complete.  These  charts  only  provide  the  estimated 
TSM  with  no  unanticipated  recovery  delay.  At  90-degrees  angle-of-bank  the  dive  angle  will  be  increasing 
and  ITSM  will  be  decreasing  slightly  faster  than  one  second  per  second  so  the  effect  of  unplanned  delay 
should  be  considered. 

The  last  three  figures,  A9  through  All,  show  the  Mach/AGF  altitude  combinations  for  8  seconds  of 
TSM  in  a  variety  of  dive  angles  during  inverted  flight.  These  predictions  assume  that  the  Nz  for  the  initial 
maneuver  is  equal  to  the  recovery  Nz.  As  with  the  90-degree  bank-angle  charts,  the  roll  rate  and  /V,  rate 
of  change  are  reduced  with  reduced  recovery  Nz  to  make  the  performance  characteristics  more  consistent. 
Inverted  recoveries  have  an  interesting  complication;  there  are  two  typical  recoveries  that  may  be  used  and 
each  one  is  “best”  for  a  different  range  of  initial  dive  angles.  The  optimum  recovery  for  shallow  dives 

1  This  follows  from  the  idea  that  8  seconds  of  TSM  is  typical  of  the  minimum  margin  routinely  used  in  basic  operational  flying 
by  qualified  pilots.  With  this  much  margin,  you  should  be  able  to  rely  upon  operationally-developed  judgment  for  dive  recovery 
safety. 
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is  called  a  nose-low  recovery  (NLR  in  the  figures).  It  entails  unloading  to  an  Nz  suitable  for  rolling — 
typically  1  g — rolling  “to  the  nearest  horizon”  (rolling  to  0-degrees  bank  angle),  then  pulling  to  a  suitable 
Nz  for  recovery.  This  recovery  minimizes  altitude  loss — and  maximizes  TSM — for  shallower  dive  angles 
but  the  act  of  unloading,  rolling,  and  loading  back  up  also  loses  significant  altitude.  If  the  dive  angle  is 
steep  enough  (about  70-degrees  dive  for  fighter-type  performance)  the  altitude  loss  will  be  minimized  and 
TSM  maximized  by  just  continuing  the  pull  until  recovery.  (This  is  called  a  split-s  recovery;  “SSR”  on  the 
figures.)  The  lines  on  these  figures  associated  with  each  depicted  dive  angle  are,  therefore,  divided  into 
two  parts.  At  lower  Mach  numbers  TSM  is  maximized  by  just  continuing  the  pull  until  recovery.  This  is 
thanks  to  the  increasing  turn  rate  for  a  given  /V,  as  Mach  number  is  decreased.  The  “knee”  in  each  dive 
angle  line  corresponds  to  the  Mach  at  which  the  NLR  and  and  the  SSR  both  produce  a  TSM  of  8  seconds. 
At  higher  Mach  numbers  the  NLR  is  optimum  and  at  lower  Mach  numbers,  the  SSR  is  optimum.  Thanks 
to  the  elevated  positive  Nz  in  inverted  flight,  the  minimum  DTSM  for  these  maneuvers  may  be  significantly 
less  than  the  TSM  depicted  on  the  figures;  thus  these  figures  should  be  used  with  caution.  If  DTSM  will  be 
used  as  the  method  for  calculating  TSM,  the  minimum  DTSM  will  never  be  greater  than  8  seconds  if  the 
starting  altitude  is  below  the  “90°  Dive,  SSR”  line. 
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8.0  Second  TSM  Estimate  for  1 .5  g  Constant  Mach  Recovery 
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Figure  A1  Eight  Second  TSM  Estimates  for  a  E5-g  Recovery  from  a  Wings-Level  Dive 


Figure  A2  Eight  Second  TSM  Estimates  for  a  2-g  Recovery  from  a  Wings-Level  Dive 
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8.0  Second  TSM  Estimate  for  2.0  g  Constant  Mach  Recovery 


8.0  Second  TSM  Estimate  for  4.0  g  Constant  Mach  Recovery 
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Figure  A3  Eight  Second  TSM  Estimates  for  a  3-g  Recovery  from  a  Wings-Level  Dive 


Figure  A4  Eight  Second  TSM  Estimates  for  a  6-g  Recovery  from  a  Wings-Level  Dive 
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8.0  Second  TSM  Estimate  for  6.0  g  Constant  Mach  Recovery 


8.0  Second  TSM  Estimate  for  2.0  g  Constant  Mach  Recovery  from  90°  Bank  Angle 


A-7 


Figure  A5  Eight  Second  ITSM  Estimates  for  a  2-g  Recovery  from  a  2-g  90-degree  Bank  Dive 


Altitude  (ft  MSL,  std  day,  sea  level  surface) 
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8.0  Second  TSM  Estimate  for  3.0  g  Constant  Mach  Recovery  from  90°  Bank  Angle 


8.0  Second  TSM  Estimate  for  4.0  g  Constant  Mach  Recovery  from  90°  Bank  Angle 
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Figure  A7  Eight  Second  ITSM  Estimates  for  a  4-g  Recovery  from  a  4-g  90-degree  Bank  Dive 
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8.0  Second  TSM  Estimate  for  6.0  g  Constant  Mach  Recovery  from  90°  Bank  Angle 


8.0  Second  TSM  Estimate  for  3.0  g  Constant  Mach  Recovery  from  180°  Bank  Angle 
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Figure  A9  Eight  Second  ITSM  Estimates  for  a  3-g  Recovery  from  a  3-g  Inverted  Dive 


Figure  A10  Eight  Second  ITSM  Estimates  for  a  4-g  Recovery  from  a  4-g  Inverted  Dive 
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8.0  Second  TSM  Estimate  for  4.0  g  Constant  Mach  Recovery  from  180°  Bank  Angle 


8.0  Second  TSM  Estimate  for  6.0  g  Constant  Mach  Recovery  from  180°  Bank  Angle 
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Figure  All  Eight  Second  ITSM  Estimates  for  a  6-g  Recovery  from  a  6-g  Inverted  Dive 
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APPENDIX  B  -  DRAFT  CHANGE  TO  AFMC  TSM  REQUIREMENTS 


As  the  Test  Information  Handbook  Time  Safety  Margin:  Theory  and  Practice  was  progressing  through 
the  final  approval  stages,  an  update  was  proposed  to  the  AFMC  requirements  regarding  the  application  of 
TSM  to  USAF  developmental  test  and  evaluation.  This  appendix  contains  the  relevant  text  of  the  draft 
change  to  AFI  11-2FT  Volume  3  Flight  Test  Operations  Procedures 1  as  it  progressed  to  the  USAF  Head¬ 
quarters  approval  process  in  July  2016. 

INTRODUCTION 

The  exact  text  of  the  change  is  provided  to  show  the  evolution  of  TSM  requirements  in  AFMC.  The 
changes  in  this  draft  were  based  primarily  on  lessons-learned  from  years  of  TSM  application  across  AFMC, 
including: 

•  Scope  of  the  Test  Maneuver:  When  TSM  was  applied  only  to  the  specific  test  maneuver,  the  maneu¬ 
ver  setup  might  be  ignored  even  though  it  could  have  a  much  lower  TSM.  For  instance,  if  a  steep  dive 
was  planned  to  achieve  the  airspeed  for  a  high-speed  low-altitude  shallow  dive  and  TSM  planning  was 
focused  solely  on  the  shallow  dive  of  the  test  point,  dive  planning  for  the  setup  could  be  inadvertently 
ignored.  (See  paragraph  3.16.15.1.1.  in  the  draft  text.) 

•  TSM  Decreasing  Faster  than  One  Second  per  Second:  This  risk  element  was  not  taken  into  ac¬ 
count  in  the  original  definition  of  TSM.  Delayed  TSM  will  meet  this  requirement.  (See  paragraph 
3.16.15.1.2.  in  the  draft  text.) 

•  Presumed  Risk  Assessment:  The  presumed  risk  assessment  levels  of  the  original  TSM  requirements 
produced  significant  unintended  consequences.  The  most  important  consequence  was  that  the  risk 
assessment  became  a  function  of  the  TSM,  often  with  no  consideration  taken  for  risk  mitigation  be¬ 
yond  the  baseline  requirements  for  the  TSM.  This  led  some  test  organizations  to  use  informal  rules 
disallowing  test  maneuvers  with  less  than  four — or  even  eight — seconds  of  TSM.  These  rules  either 
increased  the  cost  of  a  test  program  by  requiring  test  points  to  be  conducted  much  further  from  the 
home  field  (to  take  advantage  of  lower  terrain  elevation)  or — more  ominously — foreshortened  en¬ 
velope  expansion  by  preventing  investigation  of  the  lower-right-hand  corner  of  the  envelope.  The 
change  makes  it  clear  that  the  presumed  risk  mitigation  levels  only  apply  to  maneuvers  where  no  risk 
mitigation  has  been  applied.  It  is  up  to  the  SRB  to  determine  the  residual  risk  with  the  mitigation 
applied.  In  addition,  the  presumed  no-mitigation  risk  assessment  levels  were  raised  from  the  earlier 
presumed  risk  assessment  levels.  The  earlier  levels  assumed  that  the  required  risk  reduction  methods 
were  employed.  Without  risk  reduction,  the  risk  is  clearly  increased.  (See  table  3.3  in  the  draft  text.) 

•  Cued  Anticipation:  The  first  iteration  of  AFFTC  TSM  requirements  recommended  an  automatic 
recovery  system  for  any  test  point  with  less  than  1.5  seconds  of  TSM.  The  first  AFMC  iteration  of 
these  requirements  prohibited  any  test  maneuver  with  less  than  1.5  seconds  of  TSM.  Neither  of  these 
requirements  took  into  account  operational  maneuvers  such  as  low-angle  strafe  or  airshow  demon¬ 
strations.  These  maneuvers  often  use  anticipatory  cueing  to  allow  pilots  to  reliably  recover  with  less 
than  one-tenth  of  a  second  of  delay  during  maneuvers  with  less  than  1.5  seconds  of  TSM.  (See  table 
3.3  in  the  draft  text.) 


1  HQ  AFMC/A3V,  Wright-Patterson  AFB,  Ohio,  November  201 1 
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AFI 11-2FTV3  “FLIGHT  TEST  OPERATIONS  PROCEDURES”  DRAFT  TSM  REQUIREMENTS 


The  draft  change  is  provided  here  for  reference  only. 


3.6.15.  Time  Safety  Margin  (TSM). 

3.6.15.1.  For  test  points  involving  descents/dives  that  are  not  conducted  IAW  AFI  11-2FTV3, 
AFTTP  3-  series  publications,  or  the  sections  of  AFI  11-214  invoked  by  this  AFI,  base  recovery 
planning  and  risk  management  upon  the  calculated  TSM.  TSM  is  the  time  in  seconds  to  di¬ 
rectly  travel  from  the  worst  case  vector  (i.e.  worst  case  combination  of  parameters:  dive  angle, 
attitude,  airspeed,  and  available  G  that  includes  both  planned  and  maximum  allowed  devia¬ 
tion/tolerance)  to  an  unrecoverable  condition.  Use  the  following  general  planning  factors  and 
limits  when  calculating  TSM. 

3.6.15.1.1.  The  worst-case  vector  may  occur  at  any  point  during  the  entire  maneuver,  from 
the  FTT  setup  to  the  completion  of  the  recovery.  For  instance,  the  worst-case  vector  may  be 
during  FTT  setup  if  a  steep  dive  is  used  to  gain  airspeed  for  a  FTT  conducted  in  a  shallow  dive. 

3.6.15.1.2.  When  the  dive  is  becoming  steeper  at  the  dive  recovery  initiation  point,  the 
TSM  is  decreasing  faster  than  1  second  for  every  second  of  delay.  Test  teams  must  account  for 
this  additional  risk  element. 

3.6.15.1.3.  Calculate  abort/recovery  procedures  using  no  more  than  90%  of  available  air¬ 
craft  limits  and  performance  characteristics  (i.e.  roll  rate)  at  the  flight  conditions  or  90%  of  the 
flight  clearance  authorized  G  loading,  whichever  is  less.  Additionally,  minimize  any  combi¬ 
nation  of  high-G,  G  dwell  time,  high-G  onset,  roll  rate,  and  rapid  transition  from  negative  to 
positive  G. 

3.6.15.1.4.  Normal-G  onset  rate  will  be  in  accordance  with  aircraft  capabilities  at  the  test 
conditions. 

3.6.15.1.5.  Brief  all  normal-G  levels,  roll  rates  and  other  assumptions  used  to  calculate 
maneuver  TSM  to  the  technical  and  safety  review  hoards. 

3.6.15.1.6.  Use  the  procedures  outlined  in  Table  3.3  to  minimize  the  risk  of  controlled  flight 
into  terrain  (CFIT)  cognizant  that  the  charted  risk  assessment  is  prior  to  mitigation. 

3.6.15.1.7.  Regardless  of  the  TSM,  test  teams  must  be  alert  for  situations  that  may  re¬ 
quire  additional  risk  mitigation.  High  G,  poor  visibility,  pilot  distraction  on  mission  systems, 
G-induced  loss  of  consciousness  (GLOC),  and  unanticipated  engine  and  aerodynamic  charac¬ 
teristics  may  make  it  impossible  to  perform  the  planned  recovery. 
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Table  3.3.  TSM  Risk  Assessment 


Risk 

Mitigation 

Standards 

Routine 

(TSM  >  8 
sec) 

Focused 

(8  sec  > 
TSM  >4 
sec) 

Aided 

(4  sec  > 
TSM  >  2.5 
sec) 

Redundantly 
Aided 
(2.5  sec  > 
TSM  >  1.5 
sec) 

Cued 

Anticipation1 
(1.5  sec  > 
TSM  >  0 
sec) 

Minimum 

Planning 

Fidelity2 

IAW  Normal 
Operations 

M&S2 

Best 

Available 

M&S2 

Best 

Available 

M&S2 

Best 

Available 

M&S2 

Recovery 

Procedure2’3 

Routine4 

Defined  & 
Documented5 

Defined  & 
Documented5 

Defined  & 
Documented5 

Defined  & 
Documented5 

Minimum 
Training  & 
Buildup6 

Not 

Required 

In-Flight 

Buildup6 

Sim 

Rehearsal7-8 
&  In-Flight 
Buildup6 

Sim 

Rehearsal7-8 
&  In-Flight 
Buildup6 

Sim 

Rehearsal7’8 
&  In-Flight 
Buildup6 

Recovery 
Initiation  Call 

Pilot 

Pilot 

Backup  for 
Pilot9’10 

Two 

Backups  for 
Pilot9-10’11  & 
Anticipatory 
Cueing 
Desired1-912 

Backup  for 
Pilot910  & 
Anticipatory 
Cueing 
Required1-912 

Presumed 

No-Mitigation 

Risk 

Assessment13 

Low 

Medium 

High 

Very  High 

Excessive14 

Notes: 

1.  Anticipatory  cueing  provides  a  timeline  to  recovery,  e.g.  Automatic  Ground  Collision 
Avoidance  System  (AGCAS)  Heads-Up  Display  (HUD)  “chevron”  symbology  or  altitude 
countdown. 

2.  Brief  the  SRB  on  all  available  modeling  and  simulation  (M&S)  tools  and  which  was  used 
for  TSM  planning.  The  SRB  will  validate  both  the  dive  planning  M&S  and  the  planned 
recovery  procedure. 

3.  Calculate  abort/recovery  procedures  using  no  more  than  90%  of  available  aircraft  limits 
and  performance  characteristics  (i.e.  roll  rate)  at  the  flight  conditions  or  90%  of  the  flight 
clearance  authorized  G  loading,  whichever  is  less.  Additionally,  minimize  any  combina¬ 
tion  of  high-G,  G  dwell  time,  high-G  onset,  roll  rate,  and  rapid  transition  from  negative  to 
positive  G. 

4.  Initiate  recovery  immediately  after  the  test  point  is  complete. 

5.  Document  the  planned  and  worst  case  allowable  parameters,  abort  parameters  and  recov¬ 
ery  procedure  on  flight  test  cards. 

6.  Accomplish  initial  in-flight  buildup  maneuvers  with  a  minimum  TSM  of  8  seconds  to 
validate  predictions  before  proceeding  to  the  test  condition. 

7.  Simulator  rehearsals  will  include  practicing  the  complete  recovery  procedure. 

8.  Establish  crew  and  critical  test  team  member  maneuver  currency  as  paid  of  the  test  and 
safety  review  process. 
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9.  All  available  onboard  altitude  awareness  devices  will  be  briefed  and  used.  To  eliminate 
confusion  as  to  what  constitutes  an  “available”  device,  the  test  and  safety  planning  process 
will  define  the  minimum  required  onboard  devices. 

10.  The  recovery  initiation  back-up  may  be  provided  by  an  on-board  safety  crewmember,  a 
chase  aircrew,  or  control  room  personnel. 

11.  At  least  one  of  the  two  recovery  initiation  back-ups  must  be  external  to  the  test  aircraft. 
Anticipatory  cueing  may  be  used  as  one  of  the  two  pilot  backups  in  the  Redundantly  Aided 
column. 

12.  The  recovery  cueing  system  must  be  fully  qualified  prior  to  flight  then  checked  immedi¬ 
ately  prior  to  the  maneuver.  Human  intervention  to  back-up  the  cueing  system  may  not 
be  considered  risk  mitigation  for  less  than  1.5  seconds  of  TSM.  An  automatic  recovery 
system  may  be  used,  but  anticipatory  cueing  should  still  be  provided. 

13.  Risk  assessment  should  be  based  upon  the  anticipated  effectiveness  of  the  risk  mitigation 
plan.  With  no  risk  mitigation  aside  from  routine  operations  the  risk  assessment  should  not 
be  less  than  that  given  in  this  row.  The  mitigated  TSM  risk  level  is  at  the  discretion  of  the 
SRB. 

14.  Without  anticipatory  cueing,  CFIT  is  probable. 
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APPENDIX  C  -  USER  MANUAL  FOR  THE  “TSM  AWARENESS  TOOL” 


3  TSM.Tool 

Time  Safety  Margin 
Awareness  Tool 


r^ninrgi 


WARNING  This  dive  recovery  planning  tool  does  not  account  for  aircraft  performance  or  flying  qualities  (aside  from  a  very  rough  Ps  estimation) 
If  TSM<8  seconds,  it  should  only  be  used  to  conduct  initial  TSM  rough  planning,  not  to  determine  actual  TSM. 


English 


Metric 


[Energy  Approximation _ 

[  Ps  Estimate  ]  Constant  M  | 


Planned  Recovery  Transition  Points 


Initial  Climb  Angle  (-90  to  90  deg) 
Initial  Bank  Angle  (0  to  180  deg) 
Initial  Altitude  (ftMSL) 

Initial  Nz  (g,  W  for  no  pitch  rate) 
Mach  (<2.5) 

Time  at  Initial  Nz  and  Bank  (sec) 
Avg  Nz  Rate  of  Change  (g/sec) 
Tto  Roll  at  Initial  Nz 
Tto  skip  roll 
Rolling  Nz  (g) 

Avg  Roll  Rate  (deg/sec) 

Cockpit  Nz  for  Recovery  (g) 
Surface  Elevation  (ft  MSL) 

-  Ps  at  1  g  Nz  (ft/sec) 

-  Ps  at  Recov  Nz  (ft/sec) 


Planned  Recovery  Results 

Total  Altitude  Lost  (ft)  5669 
Minimum  AGL  Altitude  (ft)  4331 
Max  Dive  Angle  (deg)  -40 
Min  Alt  at  Min  Gamma  (ft  MSL)  7299 
Time  to  Level  (sec)  1 1 .3 
Recovery  Mach  Range  1 .033-1 .1 
Desired  Planned  Recovery  TSM  8 
TSM=Des’d,  Initial  Alt  (-ft  MSL)  13010 
TSM=0,  Initial  Alt  (-ft  MSL)  5730 
Planned  Recovery  TSM  (-sec)  4.8 

TSM  Mach  Range  1.03-1.2 
Compute  DTSM  Data  O1 

Minimum  Delayed  TSM  (-sec)  3.0 

Min  DTSM  Mach  Range  1.03-1.14 


Sensitivity  Analysis 


PA  (ft  MSL) 


Mach 

Enter  h,  CAS 


Solver  Time  Step 
DTSM  Time  Step 


TSM  Vector 

Start 

Delayed 

Unloaded 

Rolled 

Loaded 

33 

Hdg  (deg) 

0 

18 

31 

33 

33 

-39.9 

Pitch  {deg} 

-10 

-28.0 

-39 

-39.8 

-33 

39 

Roll  (deg) 

135 

129 

122 

0 

0 

1 

Nz(g) 

7 

7 

1 

1 

0 

7300 

Alt  (ft  MSL) 

10000 

9200 

7980 

0980 

5780 

49 

Time  (sec) 

0 

2 

4 

5.3 

7 

1.07 

Mach 

1.05 

1.03 

1.05 

1.08 

1.1 

034 

KCAS 

590 

592 

017 

042 

008 

T-38  Excess  Bank  in  the  Final..  ▼  Add  Del 


Added  Time  at  Init  Nz  and  Bank  (sec) 


0.2 

0 

6 

4330 

11.3 

1.08 
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OVERVIEW 


The  Time  Safety  Margin  Awareness  Tool  is  a  Matlab  graphical  user  interface  (GUI)  developed  to  aid  in 
the  initial  development  of  diving  maneuvers  by  providing  an  aircraft-independent  calculation  of  TSM  in  a 
way  that  will  be  useful  for  the  majority  of  potential  maneuvers.  The  tool  may  be  used  with  English  or  metric 
units.  The  user  may  choose  either  a  simple  energy  approximation  or  constant  Mach  for  the  maneuver.  Once 
the  user  inputs  the  parameters  for  the  maneuver  and  recovery,  the  tool  calculates  the  planned  recovery  TSM 
(TSM)  and  delayed  TSM  (DTSM)  and  provides  information  on  the  recovery  maneuver  including  a  graphical 
depiction  of  the  recovery  and  the  TSM-defining  scenario.  The  change  in  TSM  with  delayed  recovery  is  also 
provided  in  graphical  format.  The  user  may  save,  select,  or  delete  scenarios. 

As  TSM  gets  small  enough  to  require  risk  mitigation  greater  than  routine  pilot  actions  (generally  inter¬ 
preted  as  less  than  8  seconds)  the  accuracy  of  the  TSM  calculation  becomes  increasingly  important.  The 
TSM  Awareness  Tool  may  reasonably  be  used  for  determining  TSMs  greater  than  8  seconds  because  the 
simplifications  and  assumptions  will  generally  result  in  errors  of  much  less  than  8  seconds.  The  tool  should 
not  be  considered  adequate  for  meeting  TSM  planning  requirements  when  the  TSM  may  be  less  than  8 
seconds  but  it  is  useful  for  initial  estimates  and  maneuver  planning. 

Standard  Dive  Recovery  Profile: 

The  TSM  Awareness  Tool  is  based  upon  a  series  of  events  that  happen  in  most  dive  recoveries.  The  order 
of  these  events  cannot  be  changed  in  the  model  but  some  may  be  skipped.  The  starting  point  of  a  recovery 
(“start”)  is  defined  by  the  user;  including  altitude,  airspeed,  bank  angle,  dive  angle,  and  Nz.  The  next  step 
(“delay”)  allows  for  the  initial  Nz  with  no  roll  rate  command  to  be  held  for  a  specified  time.1  Once  this 
time  is  over,  the  “unload”  phase  is  entered  as  the  pilot  unloads  at  the  specified  g-per-second  to  the  specified 
rolling  Nz.  During  the  “roll”  phase  the  pilot  rolls  to  wings-level  flight  at  the  specified  average  roll  rate.  The 
pilot  then  pulls  to  the  specified  recovery  Nz  during  the  “load”  phase.  Finally,  the  recovery  is  “complete” 
when  level  flight  as  attained. 

There  arc  some  very  important  assumptions  that  must  be  considered  when  using  this  tool.  It  assumes  that 
the  /V,  is  not  changing  and  that  body-axis  roll  rate  is  nil  at  the  start  of  the  recovery  or  during  the  unplanned 
delay.  If  these  do  not  hold  true  for  the  end-point  of  a  planned  test  procedure,  the  TSM  may  be  decreasing 
much  more  rapidly  than  this  tool  will  calculate.  For  instance,  a  wings-level  push  to  negative  Nz,  calling  for 
decreasing  the  Nz  by  0.5  g-per-second  to  a  limit  of  -1.0  g,  could  overshoot  the  limit  should  the  recovery 
be  delayed.  As  the  actual  Nz  decreases  below  -1.0  g,  the  TSM  will  rapidly  decrease  to  less  than  the  TSM 
calculated  by  the  tool.  Carefully  choose  a  worst-case  bank  angle  and  Nz  that  take  into  account  dynamic 
overshoot  during  the  recovery. 

Notes  on  Running  the  Software: 


The  Matlab  code  in  the  TSM  Awareness  Tool  is  a  melange  of  new  code,  recycled  functions,  and  off-the- 
shelf  routines.  It  began  as  a  means  to  quantitatively  experiment  with  dive  recovery  dependencies  and  steadily 
evolved  into  its  current  form.  Results  from  the  TSM  Awareness  Tool  have  been  qualitatively  compared  to  a 
range  of  actual  dive  recoveries  and  match  well. 

Those  with  Matlab  experience  will  find  running  the  code  quite  easy.  After  opening  Matlab,  navigate  to 
the  folder  containing  the  supplied  files  and  enter  “TSM_Tool”  in  the  command  window.  The  GUI  should 
immediately  start  up. 

1  The  Euler  roll  angle  will  change  during  this  time  if  the  aircraft  is  not  at  0  or  180-degrees  bank  angle. 
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Preset  scenarios  arc  kept  in  a  file  called  “presets.mat.”  The  format  of  this  file  is  important  so — unless 
you  are  very  comfortable  with  Matlab — you  should  only  use  the  GUI  to  make  changes  to  the  file.  You  may 
have  multiple  files  of  presets  but  the  tool  only  uses  the  one  named  “presets.mat”  when  the  TSM_Tool  GUI 
is  opened.  You  must  change  the  name  of  the  preset  file  you  want  to  use  prior  to  starting  the  TSM_Tool 
GUI.  If  “presets.mat”  is  not  in  the  Matlab  path  one  will  be  created  in  the  current  Matlab  folder,  containing  a 
“Default”  preset  scenario  and  the  nine  examples  in  the  “TSM:  Theory  and  Practice”  handbook. 

The  code  uses  several  numerical  algorithms  and  iterative  processes  to  compute  the  results.  If  you  become 
impatient  with  the  time  it  is  taking  to  complete  a  calculation,  go  to  the  command  window  in  Matlab  and  type 
“Ctrl-C.”  This  will  terminate  the  code  that  is  currently  running  and  you  will  get  an  error  message.  If  you 
want  the  code  to  run  faster,  increase  the  “Solver  Time  Step”  and/or  the  “DTSM  Time  Step.” 

The  model  does  not  account  for  aircraft  flying  and  handling  qualities;  things  like  angle-of-attack,  sideslip, 
spiral  stability,  thrust,  drag,  and  gyroscopic  effects  are  not  taken  into  account.  Standard  day  conditions  arc 
assumed.  The  performance  approximation  method  can  be  much  better  than  assuming  constant  Mach,  but  it 
requires  thoughtful  use.  If  in  doubt,  start  with  the  constant  Mach  approximation. 

Sensitivity  analysis  is  available.  The  user  chooses  variations  from  the  critical  dive  recovery  parameters 
displayed  in  the  main  TSM  Tool  window  and  the  software  calculates  how  much  the  TSM  would  change  for 
each  of  those  variations.  Sensitivity  analysis  can  be  very  valuable  for  determining  where  the  most  attention 
should  be  spent  during  diving  maneuver  planning  and  execution. 

Figure  Cl  depicts  the  different  parts  of  the  GUI  that  will  be  referenced  in  this  guide. 

SETTING  UP  A  CALCULATION 

The  value  you  enter  for  calculating  TSM  should  be  the  worst-case  expected  values.  For  instance,  if  you 
are  planning  for  a  diving  test  point  you  should  have  a  maximum  allowable  dive  angle  and  minimum  altitude 
to  start  recovery;  these  arc  the  numbers  that  go  into  the  “Initial  Climb  Angle”  and  “Initial  Altitude.”  Do  not 
use  the  planned  conditions,  use  the  worst-case  allowable  test  conditions.  If  you  aren’t  sure  what  the  worst 
case  is  for  your  planned  tolerances,  this  tool  might  be  able  to  help;  you  can  test  different  cases  looking  for 
the  shortest  TSM. 

Units: 


The  TSM  Awareness  Tool  may  be  used  in  metric  or  English  units.  When  you  change  the  selection,  all 
of  the  relevant  entries  arc  automatically  converted  and  the  results  (if  calculated)  are  removed.  If  you  go 
back-and-forth  between  the  units  the  conversions  may  not  be  exact  thanks  to  rounding. 

Planned  Dive  Recovery  Information: 


Initial  Climb  Angle  (-90  to  90  deg). 


This  is  the  climb  angle  of  the  aircraft  before  any  delay.  As  with  all  vectors  in  this  tool,  it  is  in  terms  of 
the  actual  aircraft  vector,  not  the  body  axis  orientation.  For  instance,  if  the  aircraft  is  expected  to  be  in  a 
-45-degree  pitch  attitude  to  achieve  a  50-degree  dive  (-50-degree  climb  angle),  enter  “-50,”  not  “-45.” 

Initial  Bank  Angle  (0  to  180  deg). 


The  initial  bank  angle  may  only  be  entered  in  one  direction  but  the  resulting  TSM  data  will  be  the 
same;  there  are  no  asymmetries  that  must  be  accounted-for  in  the  algorithm  (such  as  propellor  torque  and 
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Figure  C 1  TSM  Awareness  Tool  GUI  Key 


asymmetric  configurations). 

Initial  Altitude  (ft  MSL)  -or-  (m  MSL). 


This  is  the  initial  altitude  before  any  delay  is  added. 

Initial  Nz  (g,  ‘99’  for  no  pitch  rate). 

The  aircraft  must  be  at  some  Nz  prior  to  the  start  of  the  recovery.  This  might  be  an  elevated  Nz,  as  in 
the  case  of  a  wind-up  turn  or  split-s,  or  it  might  be  the  Nz  necessary  to  maintain  a  constant  dive  angle.  If 
you  enter  “99”  the  tool  will  calculate  the  initial  steady-state  Nz  required  to  produce  a  body-axis  pitch  rate  of 
nil.  If  you  set  up  a  wings-level  dive  this  Nz  will  be  g  cos(yo)  where  “g”  is  the  acceleration  due  to  gravity.  If 
you  have  entered  a  non-zero  bank  angle  for  the  initial  condition  and  “99”  for  initial  Nz,  the  initial  N-  will  be 
calculated  as  g  cos(yo)  cos(r/>o).  Gravity  still  works,  of  course,  so  if  you  enter  “0”  for  the  initial  N.  the  dive 
angle  will  steepen  during  the  delay  time  and  until  the  recovery  Nz  increases  enough  to  counter  gravity. 

Mach  (<2.5), 


This  is  the  Mach  number  for  the  initial  conditions.  If  you  have  selected  “Constant  M”  in  the  energy 
approximation  section  of  the  tool,  this  Mach  will  be  held  throughout  the  recovery. 
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Time  at  Initial  Nz  and  Bank  (sec). 


You  may  use  this  delay  time — “initial  delay” — however  you  see  fit.  For  instance,  you  might  add  a  few 
seconds  of  planned  delay  time  to  account  for  pilot  reaction  time  to  an  unexpected  “Recover!”  call.  It  is 
also  useful  for  maneuver  construction,  such  as  a  planned  pre-set  time  to  maintain  an  initial  condition.  For 
instance,  a  test  team  might  plan  a  maneuver  that  requires  10  seconds  of  time  at  an  /V,  of  0  g  from  a  level 
flight  starting  condition.2 

Avg  Nz  Rate  of  Change  (g/sec). 

To  keep  things  simple,  the  same  value  for  /V,  rate  of  change  is  used  for  all  Nz  changes.  It  is  best  to 
underestimate  this,  as  reduced  /V--onset  rate  will  almost  always  decrease  TSM. 

‘1’  to  skip  unload  to  rolling  Nz. 

The  algorithm  assumes  that  the  pilot  will  unload  to  the  rolling  Nz.  If,  for  instance,  you  know  that  the  Nz 
at  the  start  of  the  recovery  is  less  than  the  asymmetric  Nz  limit  of  the  aircraft  and  the  bank  angle  is  less  than 
90  degrees,  it  might  be  prudent  to  skip  unloading  to  roll. 

‘1’  to  skip  roll. 


Sometimes,  the  best  recovery  is  accomplished  by  pulling  through  the  nadir.  Consider  a  split-s  maneuver 
at  a  very  high  Nz  that  will  be  completed  near  the  vertical.  If  the  pilot  unloads  and  rolls  to  the  nearest  horizon, 
the  TSM  can  be  much  less  than  that  achieved  by  just  maintaining  the  initial  Nz  until  recovery. 

Rolling  Nz. 

This  is  the  planned  Nz  for  any  bank  angle  changes  that  will  be  accomplished  during  the  recovery.  It 
might  be  safest  to  assume  that  the  pilot  will  unload  to  1  g  for  all  rolls.  (This  is  an  ingrained  habit  for  many 
fighter  pilots.) 

Avg  Roll  Rate  (deg/sec  average). 


This  roll  rate  is  applied  for  the  roll  to  wings  level  during  the  recovery.  Note  that  it  is  an  average  roll  rate, 
so  if  you  plan  on  using  the  maximum  available  roll  rate  of  the  aircraft,  you  will  need  to  enter  a  significantly 
reduced  roll  rate  to  account  for  roll  acceleration  and  deceleration  during  the  bank  angle  change. 

Cockpit  Nz  for  Recovery  (g). 

It  is  best  to  apply  some  conservatism  here;  do  not  plan  on  using  the  maximum  available  Nz  unless  you 
are  willing  to  risk  an  overstress  to  improve  your  TSM.  Choose  a  recovery  N-  that  will  be  available  for  the 
planned  maneuver,  taking  into  account  limiters,  stall  speed,  and  so  on. 

Surface  Elevation  (ft  MSL)  -or-  (m  MSL). 


The  tool  assumes  level  ground  under  the  recovery;  this  is  where  you  enter  that  elevation.  Be  sure  to 
use  a  conservative  estimate  of  the  terrain  elevation  underneath  the  maneuver.  If  you  plan  to  operate  above 
rapidly-changing  terrain,  this  tool  cannot  be  reasonably  used  for  TSM  calculation  unless  you  use  the  highest 
point  that  might  be  below  the  aircraft. 

2  DTSM  is  calculated  by  adding  additional  delay  to  this  step. 
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Energy  Approximation: 


The  TSM  Awareness  Tool  was  originally  designed  to  assume  constant  Mach  for  the  entire  maneuver. 
This  method  is  still  available  by  selecting  “Constant  M.”  Additional  fidelity  may  be  gained  by  selecting  “Ps 
Estimate.”  This  method  uses  a  very  simple  mapping  of  Ps  to  determine  the  change  in  energy  state  as  the 
maneuver  progresses. 

The  specific  excess  power  ( Ps )  connects  the  true  altitude  (hr)  and  true  airspeed  (W)  in  accordance  with 
the  following  equation. 


dhj  V j  dVj 
dt  g  dt 

True  airspeed  changes  to  account  for  the  total  energy  change  if  the  vertical  velocity  is  not  equivalent 
to  Ps.  The  TSM  Aw  areness  Tool  takes  advantage  of  this  by  using  the  estimated  Ps  provided  by  the  user  to 
predict  the  change  in  Vj  during  the  recovery.  The  user  provides  this  estimate  in  the  form  of  two  Ps  values; 
the  estimated  Ps  for  the  aircraft  at  1  g  and  the  estimated  Ps  for  the  aircraft  at  the  specified  recovery  Nz. 

The  Ps  used  by  the  TSM  Awareness  Tool  during  calculations  is  based  on  a  second-order  curve  fit  be¬ 
tween  the  1  g  and  recovery  N-  approximations,  anchored  by  the  assumption  that  the  slope  of  the  Ps  curve  is 
0  at  0  g.  When  either  value  is  changed  in  the  tool,  a  graphical  depiction  of  Ps  as  a  function  of  Nz  is  shown 
on  the  GUI  where  the  depiction  of  the  ITSM  and  DTSM  change  for  unplanned  delay  is  normally  displayed. 

The  resulting  estimation  is  extremely  limited.  Ps  is  strongly  influenced  by  Nz,  power  setting,  altitude, 
and  Mach  number  yet  you  can  only  provide  two  values  based  solely  on  Nz.  If  Ps  charts  arc  available,  these 
values  may  be  estimated  based  on  an  interpolation  for  the  expected  recovery  conditions.  If  these  expected 
conditions  arc  not  confirmed  upon  running  the  numbers  through  the  TSM  Awareness  Tool,  you  should 
consider  updating  your  estimates.3  You  may  use  the  energy  approximation  to  get  a  feel  for  the  effect  of 
energy  changes  on  the  dive  recovery,  but  as  the  TSM  decreases  the  simplifications  employed  in  the  TSM 
Aw  areness  Tool  will  increase  the  likelihood  that  your  actual  TSM  is  significantly  less  than  the  tool  predicts. 

~  Ps  at  lg  Nz  (ft/sec)  -or-  (m/sec). 

Enter  the  estimated  Ps  for  1  g  at  the  power  setting  you  expect  to  use  for  the  initial  conditions  and  initial 
delay  portion  of  the  maneuver.  The  graphical  depiction  of  Ps  as  a  function  of  Nz  depicted  on  the  TSM 
Aw  areness  Tool  will  update  for  the  new  information. 

~  Ps  at  Recov  Nz  (ft/sec)  -or-  (m/sec). 

Enter  the  estimated  Ps  for  the  recovery  Nz  at  the  power  setting  you  expect  to  use  for  the  recovery  portion 
of  the  maneuver.  The  graphical  depiction  of  Ps  as  a  function  of  Nz  depicted  on  the  TSM  Awareness  Tool 
will  update  for  the  new  information. 

Ps  vs  Nz  Depiction. 

This  only  appeal's  when  the  “Ps  at  lg  N”  or  “Ps  at  Recov  N”  is  changed.  If  “Compute  DTSM”  is 
selected,  when  the  TSM  calculation  is  run  the  graph  will  be  replaced  by  a  depiction  of  the  change  of  ITSM 
and  DTSM  as  a  function  of  unplanned  delay  time. 

3  One  value  of  Ps  is  relatively  easy  to  calculate.  If  you  are  planning  TSM  for  a  constant  airspeed  dive,  the  Ps  for  the  Nz  of  the  dive 
will  be  equal  to  the  vertical  component  of  the  true  airspeed. 
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Simulation  and  Airspeed  Utility: 


CAS/Mach  computation. 

Mach  number  is  of  limited  utility  in  most  aircraft,  but  the  TSM  Aw  areness  Tool  is  designed  to  “think” 
in  Mach  number.4  You  may  enter  the  pressure  altitude  (PA)  in  feet  MSL  or  meters  MSL  and/or  the  knots 
calibrated  airspeed  (KCAS)/CAS  (kph)  and  the  software  will  automatically  update  the  values  in  the  dive 
recovery  information  section.  The  resulting  Mach  number  is  retained  if  you  change  the  initial  altitude  so 
you  will  have  to  re-enter  the  KCAS  to  compute  the  correct  Mach  number  at  the  new  altitude. 

Solver  Time  Step. 


The  algorithm  for  the  TSM  Aw  areness  Tool  uses  numerical  methods  to  calculate  the  dive  recovery  data. 
It  starts  with  the  initial  conditions  then  iterates  over  time  until  recovery  is  complete.  The  “Solver  Time  Step” 
defines  the  length  of  time  for  each  iteration. 

The  default  value  of  0.02  seconds  is  more  than  accurate  enough  to  keep  the  numerical  method  errors 
“within  the  noise”  of  the  many  other  estimations  that  go  into  creating  a  profile.  Increasing  the  time  step  will 
provide  faster  results  but  with  some  cost  in  accuracy.  The  tool  limits  this  value  to  between  0.001  seconds 
(prioritizing  accuracy  over  speed)  and  0. 1  seconds  (prioritizing  speed  over  accuracy).  The  former  is  more 
than  accurate  enough  to  be  within  the  errors  produced  by  the  methodology,  and  the  latter  will  begin  to  show 
significant  inaccuracies  caused  by  stepping  through  the  numeric  calculation  too  quickly. 

DTSM  Time  Step. 


Estimating  DTSM  requires  determining  how  ITSM  changes  as  unplanned  delay  is  added.  The  DTSM 
time  step  is  the  step  size  that  the  softw  are  uses  as  it  increments  the  unplanned  delay  time  to  find  the  how  the 
DTSM  changes  with  increasing  unplanned  delay.  Increasing  this  value  makes  the  tool  run  faster  but  might 
reduce  the  quality  of  the  DTSM  estimate.  The  tool  limits  this  value  to  no  less  than  twice  the  solver  time 
step. 

RUNNING  THE  CALCULATION 

The  prominent  “RUN”  button  is  used  to  start  the  calculation  process.  The  button  will  read  “Standby” 
while  the  calculation  is  underway  and  “DONE”  once  it  is  complete.  If  any  of  the  inputs  arc  changed,  the 
results  arc  cleared  and  the  button  returns  to  displaying  “RUN.” 

PRESENTATION  OF  RESULTS 

Planned  Recovery  Results: 

These  data  are  strictly  based  on  the  planned  dive  recovery  information,  including  time  at  initial  Nz  and 
bank.  If  the  aircraft  is  in  a  climb  at  the  end  of  the  planned  delay,  the  planned  recovery  TSM  and  DTSM  arc 
not  calculated  because  the  aircraft  was  not  in  a  dive  at  the  beginning  of  the  recovery. 

Total  Altitude  Lost  (ft)  -or-  (m). 


The  difference  in  altitude  between  the  initial  altitude  and  the  dive  recovery  altitude.  Any  climbing  that 
occurs  during  the  initial  delay  is  accounted  for. 

4  Why  would  this  be?  Because  of  history;  the  original  purpose  of  the  algorithm  was  to  look  at  dive  recoveries  for  fighter  aircraft  at 
high  speed,  where  Mach  is  predominantly  used  as  a  pilot  reference  for  speed. 


C-7 


Minimum  AGL  Altitude  (ft)  -or-  (m). 


The  minimum  AGL  during  the  recovery.  This  will  always  occur  at  the  moment  the  aircraft  achieves 
level  flight,  provided  that  it  does  not  recover  during  the  initial  delay. 

Max  Dive  Angle  (deg). 

All  dive  recoveries  have  a  maximum  dive  angle  (minimum  y).  Sometimes  this  will  occur  at  an  unex¬ 
pected  point  during  the  recovery.  This  value  corresponds  to  the  maximum  dive  angle  achieved  during  the 
entire  maneuver,  including  the  user-specified  initial  delay  time. 

Min  Alt  at  Min  Gamma  (ft  MSL)  -or-  (m  MSL). 


The  minimum  altitude  at  the  maximum  dive  angle  is  a  critical  component  in  calculating  ITSM.  It  defines 
the  ITSM  vector. 

Time  to  Level  (sec). 


Most  dive  recoveries  arc  very  short-duration  events.5  The  “time  to  level”  is  the  amount  of  time  between 
the  initial  conditions  and  achievement  of  level  flight  during  the  recovery.  The  aircraft  may  be  in  a  climb 
during  the  initial  delay  time — such  as  when  a  split-s  maneuver  is  started  during  a  climb — but  the  algorithm 
does  not  check  for  a  climb  until  the  initial  delay  time  is  over.  If  the  aircraft  is  in  a  climb  at  the  end  of  the 
initial  delay  time,  no  dive  recovery  is  necessary  so  the  recovery  is  complete  before  it  started. 

Recovery  Mach  Range. 

This  result  is  visible  when  “Ps  Estimate”  is  selected  for  the  energy  approximation  and  hidden  when 
“Constant  M”  is  selected.  It  shows  the  Mach  range  encountered  during  the  entire  recovery  maneuver. 

Planned  Recovery  Transition  Points  and  Planned  Recovery  Depiction: 


The  TSM  Awareness  Tool  constructs  all  recovery  maneuvers  from  the  same  set  of  steps;  start,  initial 
delay,  adjust  to  rolling  Nz,  roll,  load  to  recovery  Nz,  pull  until  recovery.  This  section  of  the  GUI  shows  the 
state  of  the  aircraft  at  each  transition.  To  help  interpret  the  graphical  depiction  of  the  recovery  path,  the  color 
of  the  path  between  each  mode  point  is  the  same  color  as  the  bar  separating  the  mode  points. 

The  planned  recovery  depiction  also  shows  the  predicted  path  for  the  TSM-defining  recovery,  with  a 
dashed  red  line  depicting  the  TSM  path;  this  line  will  always  start  at  the  worst-case  point  in  the  planned 
recovery.  The  ground  is  depicted  as  a  sand-colored  surface. 

If  you  move  your  mouse  cursor  over  the  planned  recovery  depiction,  the  mouse  cursor  will  turn  into 
a  little  circular  arrow  and  you  can  click  and  hold  on  the  graph  to  rotate  it  and  look  at  the  recovery  from 
different  angles. 

TSM  Vector. 


The  point  during  the  recovery  that  is  used  for  computing  TSM  (the  steepest  dive  angle  at  the  lowest 
altitude)  is  depicted  in  red  on  the  left  side  of  the  planned  recovery  transition  points  chart.  It  is  also  depicted 

5  This  property  makes  an  algorithm  like  the  one  used  in  this  tool  possible.  Thank  to  the  limitations  of  numerical  methods,  as  the 
length  of  the  recovery  increases,  the  accuracy  of  the  TSM  Awareness  Tool  decreases. 
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on  the  planned  recovery  depiction  as  a  large  red  dot.  Depending  upon  the  geometry  of  the  recovery,  this 
point  may  appeal-  anywhere  from  the  initial  conditions  to  the  point  during  the  final  wings-level  pull  when 
the  Nz  increase  begins  to  reduce  the  dive  angle. 

Planned  Recovery  TSM: 

The  data  in  this  section  is  based  on  the  worst-case  planned  maneuver,  including  planned  initial  delay 
entered  as  “Time  at  Initial  Nz  and  Bank.” 

Desired  Planned  Recovery  TSM. 

It  is  common  to  seek  a  minimum  TSM  for  a  test  point.  The  TSM  Awareness  Tool  will  calculate  the 
initial  altitude  that  produces  the  desired  TSM  and  show  the  results  as  “TSM=Des’d,  Initial  Alt  (~  ft  MSL).” 
The  default  value  for  the  desired  planned  recovery  TSM  is  8  seconds. 

TSM=Des’d,  Initial  Alt  (~  ft  MSL). 


This  is  the  initial  altitude  necessary  to  provide  the  “desired  TSM.”  The  result  is  based  on  the  Mach 
calculated  for  the  specified  initial  altitude  so  if  the  entry  airspeed  is  not  defined  as  a  Mach  number  you  will 
need  to  re-run  the  model  from  the  estimated  initial  altitude  with  the  correct  Mach  number  for  that  altitude. 

TSM=0,  Initial  Alt  (~  ft  MSL). 


This  is  the  initial  altitude  that  will  provide  no  time  safety  margin. 
Planned  Recovery  TSM  (~  sec). 


This  is  the  TSM  for  the  planned  recovery,  including  planned  delay  entered  as  “Time  at  Initial  Nz  and 
Bank.” 


TSM  Mach  Range. 


This  result  is  visible  when  “Ps  Estimate”  is  selected  for  the  energy  approximation  and  hidden  when 
“Constant  M”  is  selected.  It  shows  the  Mach  range  encountered  during  the  entire  TSM-defining  recovery 
maneuver  including  the  time  on  the  TSM  vector.  The  maximum  Mach  can  be  surprisingly  high  when  TSM 
is  long  and  the  Ps  is  not  very  low  because  the  TSM  vector  calculates  the  acceleration  of  the  aircraft  using  the 
Ps  estimate;  this  estimate  does  not  take  into  account  such  things  as  aircraft  limits,  terminal  velocity,  wave 
drag,  etc.  In  most  transonic  cases,  the  actual  TSM  will  be  significantly  longer  because  the  Mach  will  be 
limited  to  less  than  that  estimated  by  the  rough  energy  approximation. 

Delayed  TSM: 

Compute  DTSM  Data. 

Select  this  to  have  the  TSM  Awareness  Tool  calculate  the  DTSM.  Calculating  DTSM  usually  requires 
much  more  time  than  calculating  the  TSM  for  the  planned  maneuver.  Deselect  this  option  if  calculating 
DTSM  is  unnecessary  or  premature. 

Minimum  Delayed  TSM  (~  sec). 


The  TSM  Awareness  Tool  adds  increments  of  unplanned  delay  to  the  “Time  at  Initial  Nz  and  Bank” 
until  the  aircraft  contacts  the  surface  elevation  during  recovery  or  the  recovery  occurs  during  the  unplanned 
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delay.  For  instance,  a  split-s  maneuver  started  high  enough  and  continued  at  the  entry  Nz  will  eventually 
result  in  a  climb  and  obviate  the  need  for  a  recovery.  The  algorithm  incrementally  adds  additional  unplanned 
delay  to  the  time  at  initial  Nz  and  bank  then  calculates  a  new  ITSM  with  that  unplanned  delay.  The  DTSM 
for  that  additional  unplanned  delay  is  equal  to  the  unplanned  delay  plus  the  associated  ITSM.  This  process 
continues  until  the  ITSM  for  the  unplanned  delay  increment  either  becomes  less  than  zero  or  the  aircraft 
completes  the  recovery  during  the  unplanned  delay.  The  result  shown  here  is  the  minimum  DTSM  for  the 
range  of  unplanned  delays. 

Keep  in  mind  that  the  flight  parameters  that  go  into  the  flight  path  for  the  unplanned  delay  arc  simply  a 
continuation  of  the  planned  recovery  parameters.  If  you  expect  significant  Nz  or  bank  angle  overshoot  that 
would  increase  the  rate  at  which  the  dive  angle  is  steepening,  use  the  maximum  expected  Nz  and  bank  angle 
to  ensure  sufficient  conservatism  in  your  DTSM  values. 

Min  DTSM  Mach  Range. 

This  result  is  visible  when  “Ps  Estimate”  is  selected  for  the  energy  approximation  and  hidden  when 
“Constant  M”  is  selected.  It  shows  the  Mach  range  encountered  during  the  entire  TSM-defining  recovery 
maneuver  for  the  amount  of  unplanned  delay  that  produces  the  minimum  DTSM. 

Depiction  of  ITSM  and  DTSM  Change  for  Unplanned  Delay: 


The  change  of  ITSM  and  DTSM  (recall  that  DTSM  is  the  sum  of  the  unplanned  delay  and  the  ITSM 
resulting  from  that  unplanned  delay)  is  depicted  in  a  graph.  In  a  constant  Mach,  constant  dive  angle  setup 
the  DTSM  remains  constant  because  each  added  second  of  unplanned  delay  reduces  the  ITSM  by  a  second. 
More  complex  recoveries  will  cause  the  DTSM  to  change  with  time.  Discontinuities  might  be  present  as 
unplanned  delay  causes  the  recovery  algorithm  to  take  a  different  path.  For  instance,  a  short  split-s  maneuver 
will  result  in  an  unload-roll-load  recovery  but  as  additional  unplanned  delay  is  added  the  unload-roll-load 
sequence  will  become  unnecessary  because  the  unplanned  delay  time  will  cause  the  aircraft  to  pull  through 
the  nadir,  eliminating  the  need  to  roll  to  the  nearest  horizon. 

SELECTING,  ADDING,  AND  DELETING  SCENARIOS 

A  drop-down  menu  is  available  to  choose  scenarios.  Scenarios  may  be  added  by  selecting  the  “Add” 
button,  entering  a  preset  scenario  title,  and  selecting  “OK.”  To  delete  a  scenario,  select  it  from  the  drop-down 
list,  select  “Del,”  and  select  “OK.”  Only  the  scenario  setup  is  stored.  You  must  run  the  simulation  to  get  the 
results. 

Presets  arc  stored  in  the  same  folder  as  the  GUI  and  code,  in  a  file  called  “presets.mat.”  If  you  want 
to  have  separate  preset  files  you  can  duplicate  the  existing  preset  file,  change  the  name  of  the  old  file  to 
something  other  than  “presets.mat,”  and  name  the  new  file  “presets.mat.”  The  TSM  Awareness  Tool  only 
uses  the  file  named  “presets.mat”  and  will  terminate  execution  for  an  error  while  opening  the  GUI  if  the  file 
is  in  the  wrong  format.  There  is  no  “undo”  command  available  when  you  delete  a  scenario. 

SENDING  RESULTS  TO  THE  MATLAB  WORKSPACE 

Advanced  users  might  want  to  run  multiple  scenarios  so  they  can  use  the  data  to  analyze  changes  in  the 
recovery  strategy.  For  instance,  you  could  run  a  series  of  scenarios  with  different  values  of  recovery  Nz  so 
you  can  chart  the  dependency  of  TSM  on  recovery  Nz.  If  you  select  “Output  results  to  Command  Window” 
the  results  of  the  simulation  will  be  placed  in  the  Command  Window  in  the  order  shown  in  table  Cl.  For 
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more  detailed  analysis,  you  may  use  “Output  States  to  Workspace.”  At  the  completion  of  the  run,  the  state 
vectors  for  the  planned  recovery  (“statel”),  the  worst  case  vector  (“mingamma_state”),  and  the  recovery 
with  the  TSM  path  (“state2”)  will  be  placed  in  the  Matlab  Workspace.  The  definition  and  units  of  the  state 
vector  arc  in  the  cell  array  “state  .units.” 

Table  C 1  Results  Placed  in  the  Matlab  Workspace 


1 

Units 

12 

Rolling  Nz 

23 

Max  Dive  Angle 

2 

Energy  Approximation 

13 

Roll  Rate 

24 

Min  Alt  at  Max  -gamma 

3 

Initial  Climb  Angle 

14 

Cockpit  Nz  for  Recovery 

25 

Min  Mach  During  Recovery 

4 

Initial  Bank  Angle 

15 

Surface  Elevation 

26 

Max  Mach  During  Recovery 

5 

Initial  Altitude 

16 

Ps  at  lg  Nz 

27 

Time  to  Level 

6 

Initial  Nz 

17 

Ps  at  Recov  Nz 

28 

Planned  Recovery  (PR)  TSM 

7 

Mach 

18 

Solver  Time  Step 

29 

Minimum  DTSM 

8 

Time  at  Initial  Nz  and  Bank 

19 

DTSM  Time  Step 

30 

0  PR  TSM  Init  Alt 

9 

Nz  Rate  of  Change 

20 

Compute  DTSM 

31 

Des'd  PR  TSM 

10 

Skip  unload  to  rolling  Nz 

21 

Total  Altitude  Lost 

32 

Des'd  PR  TSM  Init  Alt 

11 

Skip  roll 

22 

Minimum  AGL  Altitude 

TSM  SENSITIVITY  TO  CHANGES 

It  can  be  very  helpful  to  know  how  additional  errors  might  affect  the  anticipated  TSM.  For  instance,  a 
small  increase  in  dive  angle  might  have  much  greater  consequence  than  a  small  decrease  in  recovery  Nz. 
Sensitivity  analysis  is  accessed  by  selecting  the  eponymous  button  next  to  the  “Run”  button  on  the  TSM 
Tool. 

Variation: 


The  analysis  will  be  conducted  based  on  the  amount  of  variation  provided  by  the  user  in  the  “Variation” 
column  of  entry  boxes  (See  figure  C2).  These  variations  are  applied  to  the  parameters  in  the  TSM  tool  one 
at  a  time  to  calculate  the  change  in  TSM  for  each  variation.  When  the  sensitivity  analysis  (SA)  window 
is  opened,  default  variations  arc  automatically  entered  but  you  may  change  them  to  meet  your  needs.  The 
value  that  the  TSM  Tool  will  use  to  calculate  TSM  is  shown  in  the  next  column.  Select  “Run”  to  find  the 
results. 

Figure  C3  depicts  the  S  A  window  after  a  run  with  the  “Default”  TSM  Tool  parameters  and  the  default  S  A 
parameters.  The  results  arc  depicted  in  two  ways,  in  the  “TSM  secs  per  Variation”  column  and  graphically 
in  the  small  windows  under  the  “Points”  menu. 

TSM  secs  per  Variation: 


The  values  in  this  column  show  the  change  in  the  TSM  for  the  variation  provided  by  the  user.  For 
instance  in  figure  C3,  -5  degrees  of  variation  in  the  initial  climb  angle  (corresponding  to  a  50-degree  dive) 
results  in  a  TSM  reduction  of  0.78  seconds.  A  reduction  in  the  recovery  Nz  of  -0.5  g  (corresponding  to  a 
5.5-g  recovery)  only  decreases  the  TSM  by  0.20  seconds.  In  this  example,  it  might  be  prudent  to  pay  more 
attention  to  the  dive  angle  than  to  the  recovery  Nz. 
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Figure  C2  Sensitivity  analysis  window 


Figure  C3  Sensitivity  analysis  window 
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Points: 


The  small  graphs  under  the  “Points”  pull-down  depict  how  the  TSM  is  changing  on  its  way  to  the 
specified  variation.  All  of  the  graphs  have  the  same  Y  axis  scale  so  you  can  see  the  relative  effect  of  the 
variations  by  comparing  the  slope  of  their  curves.  (The  Y  axis  is  the  delta-TSM  axis;  the  scale  is  given  at  the 
bottom  of  the  column  of  graphs.  The  X  axis  is  the  variation,  from  zero  on  the  left  to  the  selected  variation 
on  the  right.)  If  the  TSM  is  increasing  or  unchanged  for  the  variation,  the  curve  is  green. 

You  choose  the  number  of  points  (in  addition  to  the  first  point  for  zero  variation  and  zero  TSM  change) 
to  be  calculated  for  these  graphs.  By  choosing  two  or  more,  you  can  better  see  how  the  TSM  is  changing 
as  it  approaches  the  chosen  variation.  The  importance  of  knowing  how  TSM  is  changing  can  be  seen  in 
figure  C3  by  examining  the  graphs  for  the  initial  climb  angle  and  cockpit  Nz  for  recovery.  In  the  former, 
the  rate  of  TSM  change  is  decreasing  with  the  variation;  the  TSM  is  getting  worse  but  the  rate  of  that 
change  indicates  that  doubling  the  variation  will  not  double  the  reduction  in  TSM.  In  the  latter,  the  slope  is 
increasing;  doubling  the  variation  for  the  recovery  Nz  will  likely  more  than  double  the  reduction  in  TSM. 
Two  points  arc  usually  enough  to  see  these  trends  over  small  variations;  up  to  eight  arc  available  if  you  arc 
willing  to  wait.  If  you  choose  one  point,  the  graphs  will  be  straight  lines.6 

Transfer  values  to  TSM  Tool: 


If  you  want  to  find  out  the  cumulative  effect  of  all  of  the  variations,  you  can  transfer  them  to  the  TSM 
Tool.  When  you  do  this,  the  values  that  were  in  the  Tool  are  stored.  You  can  put  them  back  using  a  button 
labeled  “Restore  TSM  Tool  values.”  This  button  will  appear  when  you  first  transfer  the  adjusted  values  to 
the  TSM  tool. 

Send  results  to  workspace: 


You  can  send  the  results  of  the  sensitivity  analysis  run  to  the  Matlab  workspace  by  selecting  “Send 
results  to  workspace”  after  the  run  is  complete.  This  button  is  hidden  until  there  arc  results  to  send.  The 
results  arc  given  in  a  Matlab  cell  array  with  row  and  column  headings. 


6  The  graphs  are  second-order  curve  fits  of  the  results.  The  actual  results  are  plotted  as  a  gray  line  that  is  thinner  than  the  fitted  line. 
If  the  curve  fit  is  poor,  you  will  see  the  gray  line  and  can  make  your  own  assessment  of  the  results. 
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APPENDIX  D  -  ACRONYMS,  ABBREVIATIONS,  AND  SYMBOLS 


Acronym 

Definition 

AFB 

Air  Force  Base 

AFFTC 

Air  Force  Flight  Test  Center 

AFFTCI 

Air  Force  Flight  Test  Center  Instruction 

AFI 

Air  Force  Instruction 

AFMC 

Air  Force  Material  Command 

AFTC 

Air  Force  Test  Center 

AFTCI 

Air  Force  Test  Center  Instruction 

AGL 

Above  Ground  Level 

AOA 

Angle  of  Attack 

ART 

Available  Reaction  Time 

CAS 

Calibrated  Air  Speed 

CFIT 

Controlled  Flight  Into  Terrain 

CTF 

Combined  Test  Force 

DTSM 

Delayed  Time  Safety  Margin 

EAS 

Equivalent  Air  Speed 

FLCS 

Flight  Control  System 

FPA 

Flight  Path  Angle 

GCAS 

Ground  Collision  Avoidance  System 

GLOC 

g-Induced  Loss  of  Consciousness 

GUI 

Graphical  User  Interface 

IAW 

In  Accordance  With 

ITSM 

Instantaneous  Time  Safety  Margin 

KCAS 

Knots  Calibrated  Airspeed 

KTAS 

Knots  True  Airspeed 

M&S 

Modeling  and  Simulaton 

MN 

Mach  Number 

MSA 

Minimum  Safe  Altitude 

MSL 

Mean  Sea  Level 

NASA 

National  Aeronautics  and  Space  Administration 

PA 

Pressure  Altitude 

PR 

Planned  Recovery 

RPM 

Revolutions  Per  Minute 

SRB 

Safety  Review  Board 

TPS 

Test  Pilot  School 

TSM 

Time  Safety  Margin 

TTI 

Time  to  Impact 

TTU 

Time  to  Unrecoverable 

USAF 

United  States  Air  Force 

Abbreviation 

Definition 

deg 

degree  or  degrees 

ft 

foot  or  feet 

kph 

kilometer  or  kilometers  per  hour 

lb 

pound  or  pounds 

sec 

second  or  seconds 

D-l 


Symbol 

CL 

g 

ho 

hs 

h  7 

M0 
Nz 
Nz  o 
Nzr 

N-4 

Nz 

Ps 

S 

td 

q 

vT 

r 

ro 

0 

00 

0 


Description 

Coefficient  of  lift 

Local  gravitational  acceleration 

Height  (MSL)  at  the  start  of  the  recovery  phase 

Surface  elevation  (MSL) 

True  altitude  (MSL) 

Mach  number  at  the  start  of  the  recovery  phase 
Normal  acceleration 

Normal  acceleration  at  the  start  of  the  recovery  phase 

Normal  acceleration  for  the  wings-level  recovery  pull-out 

Normal  acceleration  for  rolling 

Rate-of-change  of  normal  acceleration 

Specific  excess  power 

Wing  surface  area 

Planned  delay  at  the  beginning  of  the  recovery  phase 
Dynamic  pressure 
True  airspeed 
Climb  angle 

Climb  angle  at  the  start  of  the  recovery  phase 
Bank  angle 

Bank  angle  at  the  start  of  the  recovery  phase 
Roll  rate 


Units 

ft/sec2 

ft 

ft 

ft 

g 

g 

g 

g 

g/sec 

ft/sec 

ft2 

sec 

lb/ft2 

ft/sec 

deg 

deg 

deg 

deg 

deg/sec 
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